Security Hardening in Splunk SOAR - October 2026
Advisory ID: SVD-2026-1011
Published: 2026-10-21
Highest CVSSv3.1 Score: 9.9, Critical
Last Updated: 2026-10-21
Description
Splunk addressed multiple internally identified vulnerabilities in Splunk SOAR version 8.7.0. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information.
Solution
Upgrade Splunk SOAR to version 8.7.0 or higher.
Product Status
| Product | Base Version | Affected Version | Fix Version |
|---|---|---|---|
| Splunk SOAR | 8.7 | Below 8.7.0 | 8.7.0 |
Details
Each CVE groups findings in one CWE category. Its score is the highest CVSS score among those findings.
| CVE ID | Highest CVSS Score | Vulnerability Class (Highest-Level CWE) | Description |
|---|---|---|---|
| CVE-2026-76407 | 9.3 | CWE-284 | Improper Access Control |
| CVE-2026-76408 | 8.8 | CWE-664 | Improper Control of a Resource Through its Lifetime |
| CVE-2026-76526 | 8.8 | CWE-707 | Improper Neutralization |
| CVE-2026-76527 | 5.5 | CWE-703 | Improper Check or Handling of Exceptional Conditions |
| CVE-2026-76528 | 6.2 | CWE-693 | Protection Mechanism Failure |
| CVE-2026-76529 | 7.5 | CWE-424 | Improper Protection of Alternate Path |
| CVE-2026-76530 | 8.8 | CWE-647 | Use of Non-Canonical URL Paths for Authorization Decisions |
| CVE-2026-76531 | 9.9 | CWE-552 | Files or Directories Accessible to External Parties |