Splunk SOAR CVE-2026-76303

Exploitation requires the attacker to already hold a Splunk SOAR role granting the install_apps capability (a trusted administrative permission) and to install an app containing unsanitized, attacker-controlled documentation content. It further requires a second, separate user who holds a role with permission to view apps to be socially engineered (phished) into opening that app's documentation page in their browser - the vendor states the attacker cannot trigger it at will. Limiting factors: both the privileged install_apps capability and mandatory victim user interaction are required, and the product must be running a version below 8.7.0; this is not exploitable against default configurations by unauthenticated or low-privileged users.

This is a genuine but lower-tier priority: a moderate-severity (CVSS 5.7) stored cross-site scripting (CWE-79) flaw in Splunk SOAR below 8.7.0. The CVSS vector (AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) is internally consistent with the description - it correctly reflects that the attacker must already hold a privileged role carrying the install_apps capability (PR:H), that successful exploitation requires tricking a second user into viewing the malicious app documentation (UI:R), and that this combination is non-trivial to orchestrate (AC:H). No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there are no exploitation-probability signals to weigh against the CVSS metrics. Exploitation status is therefore: no public exploit identified at time of analysis. The high privilege requirement (an install_apps role is typically granted only to trusted administrators/engineers) combined with the mandatory social-engineering step substantially limits real-world risk - this is a privilege-escalation/lateral-movement vector within an already-trusted user population rather than an externally reachable unauthenticated bug. Note the vendor explicitly states the attacker 'should not be able to exploit the vulnerability at will' and must phish the victim, which reinforces the AC:H rating. The C:H/I:H impact rating reflects that injected script runs with the victim's session privileges, which could be high if the victim is a SOAR administrator.

A user holding a role with the install_apps capability installs an app whose documentation embeds malicious, unsanitized HTML/JavaScript. The attacker then phishes a higher-privileged SOAR user into opening that app's documentation page, at which point the script executes in the victim's browser session and performs actions or reads data with the victim's permissions. No public proof-of-concept exploit was identified in the provided intelligence.