Security Hardening Release for Splunk SOAR Connectors - August 2026

CVE-2026-76371: Incorrect Permission Assignment through Safe Mode in FireAMP for Splunk SOAR

Description

In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to file lists. The vulnerability is possible because the FireAMP connector action manifest classifies the add listitem action as read-only even though the action updates file lists. For more information see Manage settings for a playbook in Splunk SOAR in the Splunk documentation.

Bug ID: VULN-84445

CWE: CWE-732

CVSSv3.1 Score: 2.7, Low

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Mitigations and Workarounds

Turn off or remove the FireAMP app for Splunk SOAR. For more information see Add and configure apps and assets to provide actions in Splunk SOAR in the Splunk documentation. Note: Turning off the app stops all actions configured through it from running.

CVE-2026-76372: Incorrect Permission Assignment through Safe Mode in Nmap Scanner for Splunk SOAR

Description

In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system through Nmap Scripting Engine scripts. The vulnerability is possible because the Nmap Scanner connector action manifest classifies the scan network action as read-only even though the action accepts script parameters that can perform write operations. For more information see Manage settings for a playbook in Splunk SOAR in the Splunk documentation.

Bug ID: VULN-86749

CWE: CWE-732

CVSSv3.1 Score: 6.6, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Mitigations and Workarounds

Turn off or remove the Nmap Scanner app for Splunk SOAR. For more information see Add and configure apps and assets to provide actions in Splunk SOAR in the Splunk documentation. Note: Turning off the app stops all actions configured through it from running.

CVE-2026-76373: Filter Injection through Action Parameters in AD LDAP app for Splunk SOAR

Description

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could inject crafted input into an Active Directory query to enumerate Active Directory objects, including accounts, groups, and organizational units, read sensitive attributes from arbitrary directory objects, and redirect account modification actions to unintended objects. For more information see Run an action in Splunk SOAR.

Additional Solution

The fixed app version requires Splunk SOAR 8.6.0 or higher.

Bug ID: VULN-74247

CWE: CWE-90

CVSSv3.1 Score: 5.4, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Mitigations and Workarounds

Turn off or remove the AD LDAP app for Splunk SOAR. For more information see Add and configure apps and assets to provide actions in Splunk SOAR in the Splunk documentation. Note: Turning off the app stops all actions configured through it from running.

Acknowledgments: Gabriel Nitu, Splunk

CVE-2026-76374: Information Disclosure through Sensitive Data Logging in AD LDAP app for Splunk SOAR

Description

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app. For more information see Run an action in Splunk SOAR.

Additional Solution

The fixed app version requires Splunk SOAR 8.6.0 or higher.

Bug ID: VULN-74249

CWE: CWE-532

CVSSv3.1 Score: 4.3, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Mitigations and Workarounds

Turn off or remove the AD LDAP app for Splunk SOAR. For more information see Add and configure apps and assets to provide actions in Splunk SOAR in the Splunk documentation. Note: Turning off the app stops all actions configured through it from running.

Acknowledgments: Gabriel Nitu, Splunk

CVE-2026-76375: Information Disclosure through Environment Data Logging in AD LDAP app for Splunk SOAR

Description

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext. For more information see Run an action in Splunk SOAR.

Additional Solution

The fixed app version requires Splunk SOAR 8.6.0 or higher.

Bug ID: VULN-74248

CWE: CWE-532

CVSSv3.1 Score: 5.0, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Mitigations and Workarounds

Turn off or remove the AD LDAP app for Splunk SOAR. For more information see Add and configure apps and assets to provide actions in Splunk SOAR in the Splunk documentation. Note: Turning off the app stops all actions configured through it from running.

Acknowledgments: Gabriel Nitu, Splunk

CVE-2026-76376: Information Disclosure through Action Parameters in AWS IAM app for Splunk SOAR

Description

In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive AWS credentials by invoking an action that accepts the credentials parameter, because the parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR.

Additional Solution

The fixed app version requires Splunk SOAR 8.6.0 or higher.

Bug ID: VULN-86702

CWE: CWE-312

CVSSv3.1 Score: 4.3, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Mitigations and Workarounds

Turn off or remove the AWS IAM app for Splunk SOAR. For more information see Add and configure apps and assets to provide actions in Splunk SOAR in the Splunk documentation. Note: Turning off the app stops all actions configured through it from running.

CVE-2026-76377: Information Disclosure through Action Parameters in Azure AD Graph app for Splunk SOAR

Description

In versions below 2.5.3 of the Azure AD Graph app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action’s temp_password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR.

Additional Solution

The fixed app version requires Splunk SOAR 8.6.0 or higher.

Bug ID: VULN-86702

CWE: CWE-312

CVSSv3.1 Score: 4.3, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Mitigations and Workarounds

Turn off or remove the Azure AD Graph app for Splunk SOAR. For more information see Add and configure apps and assets to provide actions in Splunk SOAR in the Splunk documentation. Note: Turning off the app stops all actions configured through it from running.

CVE-2026-76378: Information Disclosure through Action Parameters in Cisco Secure Malware Analytics app for Splunk SOAR

Description

In versions below 2.4.5 of the Cisco Secure Malware Analytics app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive sample password by invoking the detonate file action, because the action’s sample_password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR.

Additional Solution

The fixed app version requires Splunk SOAR 8.6.0 or higher.

Bug ID: VULN-86702

CWE: CWE-312

CVSSv3.1 Score: 4.3, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Mitigations and Workarounds

Turn off or remove the Cisco Secure Malware Analytics app for Splunk SOAR. For more information see Add and configure apps and assets to provide actions in Splunk SOAR in the Splunk documentation. Note: Turning off the app stops all actions configured through it from running.

CVE-2026-76379: Information Disclosure through Action Parameters in Cisco Webex app for Splunk SOAR

Description

In versions below 2.2.1 of the Cisco Webex app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive meeting password by invoking the schedule meeting action, because the action’s password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR.

Additional Solution

The fixed app version requires Splunk SOAR 8.6.0 or higher.

Bug ID: VULN-86702

CWE: CWE-312

CVSSv3.1 Score: 4.3, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Mitigations and Workarounds

Turn off or remove the Cisco Webex app for Splunk SOAR. For more information see Add and configure apps and assets to provide actions in Splunk SOAR in the Splunk documentation. Note: Turning off the app stops all actions configured through it from running.

CVE-2026-76380: Information Disclosure through Action Parameters in CrowdStrike OAuth API app for Splunk SOAR

Description

In versions below 5.1.3 of the CrowdStrike OAuth API app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive document password by invoking either the detonate file or detonate url action, because the action’s document_password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR.

Additional Solution

The fixed app version requires Splunk SOAR 8.6.0 or higher.

Bug ID: VULN-86702

CWE: CWE-312

CVSSv3.1 Score: 4.3, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Mitigations and Workarounds

Turn off or remove the CrowdStrike OAuth API app for Splunk SOAR. For more information see Add and configure apps and assets to provide actions in Splunk SOAR in the Splunk documentation. Note: Turning off the app stops all actions configured through it from running.

CVE-2026-76381: Information Disclosure through Action Parameters in MS Graph for Active Directory app for Splunk SOAR

Description

In versions below 1.5.2 of the MS Graph for Active Directory app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action’s temp_password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR.

Additional Solution

The fixed app version requires Splunk SOAR 8.6.0 or higher.

Bug ID: VULN-86702

CWE: CWE-312

CVSSv3.1 Score: 4.3, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Mitigations and Workarounds

Turn off or remove the MS Graph for Active Directory app for Splunk SOAR. For more information see Add and configure apps and assets to provide actions in Splunk SOAR in the Splunk documentation. Note: Turning off the app stops all actions configured through it from running.

CVE-2026-76382: Information Disclosure through Action Parameters in Phantom app for Splunk SOAR

Description

In versions below 3.8.5 of the Phantom app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by invoking the deflate item action, because the action’s password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR.

Additional Solution

The fixed app version requires Splunk SOAR 8.6.0 or higher.

Bug ID: VULN-86702

CWE: CWE-312

CVSSv3.1 Score: 4.3, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Mitigations and Workarounds

Turn off or remove the Phantom app for Splunk SOAR. For more information see Add and configure apps and assets to provide actions in Splunk SOAR in the Splunk documentation. Note: Turning off the app stops all actions configured through it from running.

CVE-2026-76383: Information Disclosure through Action Parameters in RSA SecurID Authentication Manager app for Splunk SOAR

Description

In versions below 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive token serial by invoking either the enable token or revoke token action, because the action’s token_serial parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR.

Additional Solution

The fixed app version requires Splunk SOAR 8.6.0 or higher.

Bug ID: VULN-86702

CWE: CWE-312

CVSSv3.1 Score: 4.3, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Mitigations and Workarounds

Turn off or remove the RSA SecurID Authentication Manager app for Splunk SOAR. For more information see Add and configure apps and assets to provide actions in Splunk SOAR in the Splunk documentation. Note: Turning off the app stops all actions configured through it from running.

CVE-2026-76384: Information Disclosure through Action Parameters in Splunk Attack Analyzer Connector for Splunk SOAR

Description

In versions below 2.2.1 of the Splunk Attack Analyzer Connector for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by invoking either the detonate file or detonate url action, because the action’s archive_password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR.

Additional Solution

The fixed app version requires Splunk SOAR 8.6.0 or higher.

Bug ID: VULN-86702

CWE: CWE-312

CVSSv3.1 Score: 4.3, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Mitigations and Workarounds

Turn off or remove the Splunk Attack Analyzer Connector for Splunk SOAR. For more information see Add and configure apps and assets to provide actions in Splunk SOAR in the Splunk documentation. Note: Turning off the app stops all actions configured through it from running.

CVE-2026-76385: Information Disclosure through Action Parameters in Venafi app for Splunk SOAR

Description

In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwords by invoking the get certificate action, because the action’s keystore_password and password parameters are not masked and are shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameters as passwords. For more information see Run an action in Splunk SOAR.

Additional Solution

The fixed app version requires Splunk SOAR 8.6.0 or higher.

Bug ID: VULN-86702

CWE: CWE-312

CVSSv3.1 Score: 4.3, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Mitigations and Workarounds

Turn off or remove the Venafi app for Splunk SOAR. For more information see Add and configure apps and assets to provide actions in Splunk SOAR in the Splunk documentation. Note: Turning off the app stops all actions configured through it from running.

CVE-2026-76386: Information Disclosure through Action Parameters in Zoom app for Splunk SOAR

Description

In versions below 3.2.2 of the Zoom app for Splunk SOAR, a user who holds a role with permission to run actions could expose meeting and personal meeting ID passwords by invoking one of the create meeting, update meeting, or update user settings actions, because the affected password and pmi_password parameters are not masked and are shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameters as passwords. For more information see Run an action in Splunk SOAR.

Additional Solution

The fixed app version requires Splunk SOAR 8.6.0 or higher.

Bug ID: VULN-86702

CWE: CWE-312

CVSSv3.1 Score: 4.3, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Mitigations and Workarounds

Turn off or remove the Zoom app for Splunk SOAR. For more information see Add and configure apps and assets to provide actions in Splunk SOAR in the Splunk documentation. Note: Turning off the app stops all actions configured through it from running.