Improper access control in Splunk Security Orchestration, Automation and Response (SOAR) - CVE-2026-76407
Published: October 22, 2026
Vulnerability identifier: #VU157026
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76407
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to potentially access resources or perform operations without appropriate authorization.
The vulnerability exists due to improper access control in Splunk SOAR when enforcing restrictions on access to resources or operations. A remote attacker can attempt access that is not adequately restricted to potentially bypass intended authorization boundaries.
Affected software
Splunk Security Orchestration, Automation and Response (SOAR)
How to mitigate CVE-2026-76407
Install security update from vendor's website.
Splunk Security Orchestration, Automation and Response (SOAR) - update to 8.7.0