Splunk SOAR CVE-2026-76362

Exploitation requires the attacker to hold an active network-path interception position between the Splunk SOAR instance and the CyberArk REST server - achievable via ARP poisoning on a shared LAN segment, BGP route injection, or compromise of an intermediary network device, but not from an arbitrary internet vantage point. The CyberArk REST credential manager integration must be explicitly configured in Splunk SOAR; instances not using CyberArk as a password vault are entirely unaffected by this flaw. The CVSS PR:N and UI:N confirm no authentication or user interaction is required once network position is established. Exploitation is bounded to the credential data channel between SOAR and CyberArk - it does not directly expose Splunk SOAR's internal data or other integrations. The AC:H rating reflects that achieving the required network interception position is a non-trivial prerequisite that limits opportunistic exploitation.

The CVSS 3.1 base score of 7.4 (High) is well-calibrated: AV:N reflects that the attack traverses the network, AC:H captures the non-trivial prerequisite of achieving a man-in-the-middle position between Splunk SOAR and the CyberArk REST server, and C:H/I:H/A:N accurately reflects the high-value credential data exposed without any availability disruption. In practice, AC:H is the primary limiting factor - exploitation requires internal network access or compromise of a routing device, not merely internet reachability, which meaningfully constrains opportunistic attackers. No EPSS score was supplied in the provided data, and this CVE is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. That said, the integrity impact deserves particular attention: an attacker can not only read vault credentials but inject falsified credential responses into SOAR playbook execution, potentially redirecting automation to attacker-controlled infrastructure. Even a mid-sized security operations team should treat this as high priority if the CyberArk integration is active, since the blast radius of compromised PAM credentials extends well beyond the SOAR platform itself. The absence of a POC and KEV listing moderates urgency slightly, but the sensitivity of the data class (privileged credentials) elevates real-world risk above what the base score alone might suggest.

An attacker with access to the internal network segment shared by Splunk SOAR and the CyberArk REST server uses ARP spoofing or a compromised network device to position themselves in the traffic path. They terminate the TLS connection from Splunk SOAR using a self-signed certificate, which the CyberArk REST client accepts without error, then proxy requests to the real CyberArk server - decrypting and optionally modifying all credential vault responses in transit. Standard MITM tooling is sufficient; no CVE-specific exploit code is required.