SB20261022323 - Multiple vulnerabilities in Splunk Security Orchestration, Automation and Response (SOAR)
Published: October 22, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2026-76407)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially access resources or perform operations without appropriate authorization.
The vulnerability exists due to improper access control in Splunk SOAR when enforcing restrictions on access to resources or operations. A remote attacker can attempt access that is not adequately restricted to potentially bypass intended authorization boundaries.
2) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-76408)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to potentially disrupt resource management and interfere with normal operation.
The vulnerability exists due to improper control of a resource through its lifetime in Splunk SOAR when managing resource creation, use, or release. A remote user can trigger affected resource-management behavior to potentially leave resources in an invalid state and disrupt normal operation.
3) Improper Neutralization (CVE-ID: CVE-2026-76526)
CWE-ID: CWE-707 - Improper Neutralization
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to potentially alter how supplied data is interpreted and cause unintended processing.
The vulnerability exists due to improper neutralization in Splunk SOAR when processing data containing elements with special meaning in a downstream context. A remote user can supply specially crafted data to potentially cause those elements to be interpreted as control information rather than ordinary data.
4) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-76527)
CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially disrupt normal operation by triggering improperly handled exceptional conditions.
The vulnerability exists due to improper checking or handling of exceptional conditions in Splunk SOAR when unexpected conditions arise during processing. A local user can trigger an affected exceptional condition to potentially interrupt processing or leave the application in an inconsistent state.
5) Protection mechanism failure (CVE-ID: CVE-2026-76528)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially bypass intended security protections.
The vulnerability exists due to a protection mechanism failure in Splunk SOAR when enforcing security restrictions. A remote attacker can exploit ineffective enforcement to potentially perform actions that the affected protection mechanism is intended to prevent.
6) Improper Protection of Alternate Path (CVE-ID: CVE-2026-76529)
CWE-ID: CWE-424 - Improper Protection of Alternate Path
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially bypass security restrictions through an alternate access path.
The vulnerability exists due to improper protection of an alternate path in Splunk SOAR when a protected resource or operation is accessed through a different route. A remote attacker can use an insufficiently protected alternate path to potentially avoid security checks applied to the intended access path.
7) Use of Non-Canonical URL Paths for Authorization Decisions (CVE-ID: CVE-2026-76530)
CWE-ID: CWE-647 - Use of Non-Canonical URL Paths for Authorization Decisions
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to potentially bypass authorization checks and access restricted resources.
The vulnerability exists due to the use of non-canonical URL paths for authorization decisions in Splunk SOAR when evaluating access to requested resources. A remote user can submit an alternative URL representation of a protected resource to potentially evade authorization checks that do not account for equivalent paths.
8) Files or Directories Accessible to External Parties (CVE-ID: CVE-2026-76531)
CWE-ID: CWE-552 - Files or Directories Accessible to External Parties
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially access files or directories that should be restricted.
The vulnerability exists due to insufficient restrictions on externally accessible files or directories in Splunk SOAR when exposing filesystem resources to external parties. A remote attacker can access exposed resources to potentially obtain file contents or directory information outside the intended access boundaries.
9) Cross-site scripting (CVE-ID: CVE-2026-76303)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote privileged user to execute stored JavaScript in another user's browser and access data or make changes with that user's permissions.
The vulnerability exists due to improper sanitization of app documentation in Splunk SOAR when displaying documentation from installed apps. A remote privileged user can install an app containing malicious documentation using the install_apps capability and trick another user with permission to view apps into opening the documentation through a browser request to execute the content with the victim's permissions.
10) Missing Authorization (CVE-ID: CVE-2026-76304)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose Automation Broker configuration information without the required permission.
The vulnerability exists due to missing authorization in Splunk SOAR's Automation Broker configuration download functionality when handling configuration file requests. A remote user can request the Docker Compose configuration file without the Automation Broker edit permission to obtain the instance URL, container image location, and Automation Broker version.
11) Missing Authorization (CVE-ID: CVE-2026-76305)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose installed app archive contents, including proprietary source code and sensitive information.
The vulnerability exists due to missing authorization in Splunk SOAR's app download functionality when returning installed app archives. A remote user can request an app archive without permission to view apps to obtain all data contained in the archive.
12) Information disclosure (CVE-ID: CVE-2026-76306)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to infer other users' password hashes and authorization tokens, potentially enabling unauthorized access, data modification, and service disruption.
The vulnerability exists due to exposure of sensitive user record fields in Splunk SOAR's REST API when applying query filters before protecting those fields from query processing. A remote user can use the Observer role to submit query filters targeting sensitive fields to infer password hashes and authorization tokens, potentially compromising the confidentiality, integrity, and availability of the instance through unauthorized access.
13) Information disclosure (CVE-ID: CVE-2026-76307)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to infer other users' authentication tokens and potentially gain administrative access, enabling disclosure or modification of data and disruption of service.
The vulnerability exists due to exposure of sensitive user record fields in Splunk SOAR's REST API when processing caller-controlled query filters. A remote privileged user can use the Users and Roles view permission to submit filters targeting sensitive fields to infer authentication tokens and, if a recovered token grants administrative access, take administrative control of the instance.
14) Missing Authorization (CVE-ID: CVE-2026-76308)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to change the Enterprise Security edition and cause Splunk SOAR to apply an unauthorized license change.
The vulnerability exists due to missing authorization in Splunk SOAR's REST API when processing requests to manage the Enterprise Security edition. A remote user can submit an authenticated request to change the edition without the required authorization to cause the instance to apply the license change.
15) Observable discrepancy (CVE-ID: CVE-2026-76406)
CWE-ID: CWE-203 - Observable discrepancy
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to decrypt and disclose credential data obtained in encrypted form from an affected Splunk SOAR instance.
The vulnerability exists due to decryption of encrypted Basic authentication values before authentication checks are completed in Splunk SOAR's REST API when processing authentication data. A remote attacker can submit Basic authentication data containing previously obtained encrypted credentials from the affected instance to expose the decrypted credential data.
Remediation
Install update from vendor's website.