EUVD-2026-62930

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language SQL statements against the Splunk SOAR database through custom list retrieval in a playbook, allowing for create, read, update, and delete operations on a...

EUVD-2026-62929

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language SQL statements against the Splunk SOAR database through custom function results, allowing for reading all relevant data stored in the Splunk SOAR database...

CVE-2026-76365

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language SQL statements against the Splunk SOAR database through custom list retrieval in a playbook, allowing for create, read, update, and delete operations on a...

CVE-2026-76364

In Splunk SOAR versions below 8.6.0, a user holding the "Automation Engineer" role can inject arbitrary SQL via custom function results, because Splunk SOAR builds the database lookup using a supplied name instead of a bound SQL value, enabling full database read access and integrity compromise. ...

CVE-2026-76363

Splunk SOAR versions below 8.6.0 allow an "Automation Engineer" to inject arbitrary SQL via the playbook automation data REST API, enabling full read/write/delete of the database. Splunk advisory SVD-2026-0804 confirms the fix; no in-the-wild exploitation is reported. Upgrade to 8.6.0 or later.