CVE-2026-76381 Information Disclosure through Action Parameters in MS Graph for Active Directory app for Splunk SOAR

In versions below 1.5.2 of the MS Graph for Active Directory app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temppassword parameter is not masked and is shown in cleartext in...

CVE-2026-76380 Information Disclosure through Action Parameters in CrowdStrike OAuth API app for Splunk SOAR

In versions below 5.1.3 of the CrowdStrike OAuth API app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive document password by invoking either the detonate file or detonate url action, because the action's documentpassword parameter is not masked an...

CVE-2026-76381

CVE-2026-76381 is an information disclosure vulnerability in the MS Graph for Active Directory app for Splunk SOAR , affecting versions below 1.5.2 . The root cause is that the temp_password parameter in the reset password action is not marked as a password field, causing it to be displayed in cl...

CVE-2026-76379

CVE-2026-76379 is an information disclosure vulnerability in the Cisco Webex app for Splunk SOAR (versions below 2.2.1 ). The root cause is that the app does not mark the password parameter of the schedule meeting action as a password field, causing it to be displayed in cleartext in the user int...

CVE-2026-76379 Information Disclosure through Action Parameters in Cisco Webex app for Splunk SOAR

In versions below 2.2.1 of the Cisco Webex app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive meeting password by invoking the schedule meeting action, because the action's password parameter is not masked and is shown in cleartext in the user...

CVE-2026-76379 Information Disclosure through Action Parameters in Cisco Webex app for Splunk SOAR

In versions below 2.2.1 of the Cisco Webex app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive meeting password by invoking the schedule meeting action, because the action's password parameter is not masked and is shown in cleartext in the user...

CVE-2026-76377 Information Disclosure through Action Parameters in Azure AD Graph app for Splunk SOAR

In versions below 2.5.3 of the Azure AD Graph app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temppassword parameter is not masked and is shown in cleartext in the user...

CVE-2026-76378 Information Disclosure through Action Parameters in Cisco Secure Malware Analytics app for Splunk SOAR

In versions below 2.4.5 of the Cisco Secure Malware Analytics app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive sample password by invoking the detonate file action, because the action's samplepassword parameter is not masked and is shown in...

CVE-2026-76377

CVE-2026-76377 affects the Azure AD Graph app for Splunk SOAR in versions below 2.5.3 . The root cause is that the temp_password parameter in the reset password action is not marked as a password field, causing it to be displayed in cleartext in the Splunk SOAR user interface. Any user with a rol...

CVE-2026-76378

In Cisco Secure Malware Analytics app for Splunk SOAR versions below 2.4.5, the detonate file action's sample_password parameter is not marked as a password type, causing it to display in cleartext in the UI. Any user with action-run permissions can read the sensitive password. CVSS 3.1 scores th...

CVE-2026-76376

In versions below 2.1.9 of the AWS IAM app for Splunk SOAR , a user with permission to run actions can expose sensitive AWS credentials in cleartext through the user interface. The root cause is that the affected action parameter is not marked as a password , so it is not masked when displayed. T...

CVE-2026-76376 Information Disclosure through Action Parameters in AWS IAM app for Splunk SOAR

In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive AWS credentials by invoking an action that accepts the credentials parameter, because the parameter is not masked and is shown in cleartext in the user...

CVE-2026-76375 Information Disclosure through Environment Data Logging in AD LDAP app for Splunk SOAR

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext. For more...

CVE-2026-76375

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR , a user with permission to run actions can trigger an action that causes the full connector process environment to be written to a persistent debug log file in plaintext , exposing sensitive credentials. This is an information disclosure...

CVE-2026-76374 Information Disclosure through Sensitive Data Logging in AD LDAP app for Splunk SOAR

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app. For more information see Run an acti...

CVE-2026-76374

In AD LDAP app for Splunk SOAR versions below 2.3.8, a low-privileged user with action-run permissions can trigger write operations that persist sensitive Active Directory response data to a debug log file, causing information disclosure. CVSS 3.1 scores it MEDIUM (4.3). Update to version 2.3.8. ...

CVE-2026-76374 Information Disclosure through Sensitive Data Logging in AD LDAP app for Splunk SOAR

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app. For more information see Run an acti...

CVE-2026-76372

CVE-2026-76372 affects the Nmap Scanner connector for Splunk SOAR in versions below 3.0.15 . The root cause is an incorrect permission classification: the connector's action manifest marks the scan network action as read-only , yet the action accepts Nmap Scripting Engine (NSE) script parameters ...

CVE-2026-76372 Incorrect Permission Assignment through Safe Mode in Nmap Scanner for Splunk SOAR

In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system...

CVE-2026-76373 Filter Injection through Action Parameters in AD LDAP app for Splunk SOAR

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could inject crafted input into an Active Directory query to enumerate Active Directory objects, including accounts, groups, and organizational units, read sensitive attributes from...