Observable discrepancy in Splunk Security Orchestration, Automation and Response (SOAR) - CVE-2026-76406
Published: October 22, 2026
Vulnerability identifier: #VU157064
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76406
CWE-ID: CWE-203
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to decrypt and disclose credential data obtained in encrypted form from an affected Splunk SOAR instance.
The vulnerability exists due to decryption of encrypted Basic authentication values before authentication checks are completed in Splunk SOAR's REST API when processing authentication data. A remote attacker can submit Basic authentication data containing previously obtained encrypted credentials from the affected instance to expose the decrypted credential data.
Affected software
Splunk Security Orchestration, Automation and Response (SOAR)
How to mitigate CVE-2026-76406
Install security update from vendor's website.
Splunk Security Orchestration, Automation and Response (SOAR) - update to 8.7.0