Cross-site scripting in Splunk Security Orchestration, Automation and Response (SOAR) - CVE-2026-76303
Published: October 22, 2026
Vulnerability identifier: #VU157058
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-76303
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to execute stored JavaScript in another user's browser and access data or make changes with that user's permissions.
The vulnerability exists due to improper sanitization of app documentation in Splunk SOAR when displaying documentation from installed apps. A remote privileged user can install an app containing malicious documentation using the install_apps capability and trick another user with permission to view apps into opening the documentation through a browser request to execute the content with the victim's permissions.
Affected software
Splunk Security Orchestration, Automation and Response (SOAR)
How to mitigate CVE-2026-76303
Install security update from vendor's website.
Splunk Security Orchestration, Automation and Response (SOAR) - update to 8.7.0