Splunk SOAR CVE-2026-76359

Exploitation requires the attacker to hold the Splunk SOAR Administrator role, the highest privilege tier in SOAR On-premises, as confirmed by the CVSS PR:H metric and the vendor's own role documentation. The vulnerable code path is specifically the Universal Forwarder credentials-package extraction workflow, accessible only to Administrators configured to manage forwarder integrations (see Configure forwarders to send SOAR data to your Splunk deployment in Splunk documentation). The deployment must be Splunk SOAR On-premises at a version below 8.6.0. No user interaction is required beyond the attacker's own authenticated session (UI:N). Exploitation is bounded by the authentication barrier: external unauthenticated attackers cannot reach this workflow without first compromising a valid Administrator account. No special network conditions or non-default configurations beyond standard Administrator access to the SOAR management interface are necessary.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) accurately reflects the high-privilege prerequisite (Administrator role, PR:H) that materially constrains this vulnerability's external attack surface. For an unauthenticated attacker, this flaw is not directly reachable; it is primarily a post-compromise escalation or insider-threat vector. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV and no public proof-of-concept has been identified, indicating no confirmed or widespread exploitation at time of analysis. Despite the reduced external risk, the I:H and A:H ratings are substantive: an insider or compromised Administrator account could overwrite OS-level binaries or configuration files, potentially achieving effects beyond SOAR itself. The S:U scope rating is consistent - impact remains on the SOAR host - but defenders should consider that arbitrary filesystem writes at Administrator-level could enable OS-layer persistence. Overall, this is a real but operationally bounded risk: organizations should prioritize patching but need not treat it as an emergency if Administrator account access is well-controlled.

An attacker in possession of Splunk SOAR Administrator credentials crafts a malicious archive containing entries with path traversal sequences - for example, a member named '../../etc/cron.d/persistence' - and submits it through the Universal Forwarder credentials-package workflow. Because the extraction routine does not validate destination paths, the file is written to /etc/cron.d/ on the SOAR host rather than the installation directory, establishing persistent execution under the OS scheduler. No public proof-of-concept has been identified at time of analysis, but the technique mirrors well-documented Zip Slip exploits requiring only standard archive crafting tools.