PT-2026-78798

In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to file lists. The vulnerability is...

PT-2026-78783

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description An unauthenticated user can execute arbitrary code on the host by spoofing the source IP address in a crafted request to an Automation Broker notification endpoint. This occurs because the...

PT-2026-78785

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A path traversal issue exists in the archive extraction routine during app installation. This occurs because the system fails to validate that extracted file paths remain within the intended...

PT-2026-78808

In versions below 1.5.2 of the MS Graph for Active Directory app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temp password parameter is not masked and is shown in cleartext in...

PT-2026-78788

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A user with the Administrator role can perform Server-Side Request Forgery SSRF—a technique where an attacker forces a server to make requests to an unintended location—via the...

PT-2026-78797

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description An authenticated user with restricted tenant access can use the Representational State Transfer REST API to view the names and identifiers of tenants that are outside their assigned role scope...

PT-2026-78791

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A user with the Automation Engineer role can execute arbitrary Structured Query Language SQL statements against the database via custom function results. This occurs because the system constructs...

CVE-2026-20260

In Splunk SOAR Security Orchestration, Automation, and Response versions below 8.5.0, an unauthenticated attacker could inject American National Standards Institute ANSI escape codes into SOAR application log files through specially crafted HTTP request paths, which a terminal emulator might...

CVE-2026-20260 Log Injection through HTTP Request Paths in Splunk SOAR

In Splunk SOAR Security Orchestration, Automation, and Response versions below 8.5.0, an unauthenticated attacker could inject American National Standards Institute ANSI escape codes into SOAR application log files through specially crafted HTTP request paths, which a terminal emulator might...

CVE-2026-20260

In Splunk SOAR (Security Orchestration, Automation, and Response) versions below 8.5.0, an unauthenticated attacker can inject ANSI escape codes into SOAR logs via specially crafted HTTP request paths. The root cause is that SOAR does not strip control characters from HTTP request paths before wr...

Splunk SOAR 安全漏洞

Splunk SOAR is a security orchestration, automation, and response platform provided by Splunk Inc. Versions of Splunk SOAR prior to 8.5.0 contained a security vulnerability. This vulnerability stemmed from SOAR failing to strip control characters from the HTTP request path before writing...

CVE-2026-20260: Improper Output Neutralization for Logs

In Splunk SOAR Security Orchestration, Automation, and Response versions below 8.5.0, an unauthenticated attacker could inject American National Standards Institute ANSI escape codes into SOAR application log files through specially crafted HTTP request paths, which a terminal emulator might...

EUVD-2023-44620

Malicious code in bioql PyPI...

Vulnerability fixed in Splunk SOAR

Splunk has fixed a vulnerability in Splunk SOAR. The vulnerability allows an unauthenticated malicious person to inject inject ANSI escape code into a log file. To do so, the malicious party must send a specially prepared HTTP request to the Spunk SOAR instance. When this log file is read in a...

The vulnerability of Splunk SOAR’s software for orchestration, automation, and incident response lies in its improper handling of output data from registration logs, allowing attackers to execute arbitrary code.

The vulnerability of Splunk SOAR’s software for orchestration, automation, and security incident response is related to improper processing of output data from registration logs. Exploiting this vulnerability can allow a perpetrator to execute arbitrary code...

CVE-2023-3997

Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to vi...

CVE-2023-3997

Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to vi...

Design/Logic Flaw

Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to vi...

CVE-2023-3997 Unauthenticated Log Injection In Splunk SOAR

Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to vi...

PT-2023-4030 · Splunk · Splunk Soar

Name of the Vulnerable Software and Affected Versions: Splunk SOAR versions prior to 6.1.0 Description: The issue is related to the incorrect handling of log output, which can be exploited by sending a maliciously crafted web request containing special ANSI characters to cause log file poisoning...