Missing Authorization in Splunk Security Orchestration, Automation and Response (SOAR) - CVE-2026-76308
Published: October 22, 2026
Vulnerability identifier: #VU157063
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76308
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to change the Enterprise Security edition and cause Splunk SOAR to apply an unauthorized license change.
The vulnerability exists due to missing authorization in Splunk SOAR's REST API when processing requests to manage the Enterprise Security edition. A remote user can submit an authenticated request to change the edition without the required authorization to cause the instance to apply the license change.
Affected software
Splunk Security Orchestration, Automation and Response (SOAR)
How to mitigate CVE-2026-76308
Install security update from vendor's website.
Splunk Security Orchestration, Automation and Response (SOAR) - update to 8.7.0