Improper Neutralization in Splunk Security Orchestration, Automation and Response (SOAR) - CVE-2026-76526
Published: October 22, 2026
Vulnerability identifier: #VU157028
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76526
CWE-ID: CWE-707
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to potentially alter how supplied data is interpreted and cause unintended processing.
The vulnerability exists due to improper neutralization in Splunk SOAR when processing data containing elements with special meaning in a downstream context. A remote user can supply specially crafted data to potentially cause those elements to be interpreted as control information rather than ordinary data.
Affected software
Splunk Security Orchestration, Automation and Response (SOAR)
How to mitigate CVE-2026-76526
Install security update from vendor's website.
Splunk Security Orchestration, Automation and Response (SOAR) - update to 8.7.0