CVE-2026-76357 Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the Representational State Transfer REST API and execute arbitrary code. The vulnerability is possible because the REST API does not require an assigned role for the request and do...

CVE-2026-76358

In Splunk SOAR versions below 8.6.0, the app-installation archive extraction routine fails to validate extracted file paths, allowing users with app-install privileges to write files outside the intended temporary directory, enabling arbitrary file overwrite (HIGH integrity/availability impact, C...

CVE-2026-76356 Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAR

In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to an Automation Broker notification endpoint and execute arbitrary code on the Splunk SOAR host. The vulnerability is possible because the Splunk SOAR Automation Broker trusts a...

CVE-2026-76356

Splunk SOAR versions below 8.6.0 are vulnerable: the Automation Broker trusts a client-supplied source IP header, allowing an unauthenticated attacker to spoof the local system IP and execute arbitrary code on the host. CVSS 8.1 (HIGH). No exploit code or in-the-wild exploitation is documented. U...

PT-2026-78802

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext. For more...

PT-2026-78796

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A user with the OnPrem Broker role can write files outside the designated Automation Broker log directory. This occurs because the Automation Broker log upload process accepts crafted filename...

PT-2026-78794

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A stored Cross-Site Scripting XSS issue exists where a user with the "Incident Commander" role can store JavaScript within a note. This occurs because the system may treat note content as Hyperte...

PT-2026-78787

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description An authenticated user without an assigned role can access the '/rest/health' endpoint to collect system and cluster telemetry. This occurs due to a missing authorization check, as the endpoint...

PT-2026-78784

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description An authenticated user without an assigned role can execute arbitrary code by submitting a crafted file path to the Representational State Transfer REST API. This occurs because the REST API does...

PT-2026-78786

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A user with the Administrator role can perform path traversal during the archive extraction process of the Universal Forwarder installer. This occurs because the credentials-package extraction...

PT-2026-78792

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A user with the Automation Engineer role can execute arbitrary Structured Query Language SQL statements against the database. This occurs during custom list retrieval within a playbook, enabling...

PT-2026-78789

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description An unauthenticated user with the ability to intercept network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer REST server can access or modify data exchanged...

PT-2026-78790

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A user with the Automation Engineer role can execute arbitrary Structured Query Language SQL statements against the database. This allows for the creation, reading, updating, or deletion of all...

PT-2026-78795

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A user with a role containing the playbooks:view permission can access metadata regarding a playbook repository they are not authorized to view. This occurs because the Playbook History feature...

PT-2026-78791

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A user with the Automation Engineer role can execute arbitrary Structured Query Language SQL statements against the database via custom function results. This occurs because the system constructs...

PT-2026-78797

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description An authenticated user with restricted tenant access can use the Representational State Transfer REST API to view the names and identifiers of tenants that are outside their assigned role scope...

PT-2026-78788

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A user with the Administrator role can perform Server-Side Request Forgery SSRF—a technique where an attacker forces a server to make requests to an unintended location—via the...

PT-2026-78785

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A path traversal issue exists in the archive extraction routine during app installation. This occurs because the system fails to validate that extracted file paths remain within the intended...

PT-2026-78783

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description An unauthenticated user can execute arbitrary code on the host by spoofing the source IP address in a crafted request to an Automation Broker notification endpoint. This occurs because the...

CVE-2026-20260

In Splunk SOAR Security Orchestration, Automation, and Response versions below 8.5.0, an unauthenticated attacker could inject American National Standards Institute ANSI escape codes into SOAR application log files through specially crafted HTTP request paths, which a terminal emulator might...