Splunk SOAR CVE-2026-76363

Exploitation requires possession of the 'Automation Engineer' role within the target Splunk SOAR instance - this is a specific platform role assignable to SOC analysts and automation developers, not a default or anonymous account. The attacker must have valid credentials for an account with this role and network access to the SOAR API endpoint. This makes the primary exploitation scenarios a malicious insider or an attacker who has separately compromised an Automation Engineer account. No non-default configuration settings are required beyond role assignment. Exploitation is bounded to Splunk SOAR versions below 8.6.0; the unchanged scope (S:U) means the vulnerability does not inherently pivot to adjacent systems. Limiting factors for defenders: the role requirement creates a meaningful authentication and authorization barrier, and monitoring for anomalous database query patterns from SOAR service accounts can serve as an early detection signal.

The CVSS 3.1 base score of 6.5 reflects a network-accessible (AV:N), low-complexity (AC:L) attack constrained by a high privilege requirement (PR:H), corresponding to the 'Automation Engineer' role. While PR:H nominally limits the attack surface, this is a standard operational role assigned to SOC analysts and automation developers - not a sole-admin account - meaning the population of potential threat actors is larger than a true superuser-only flaw. The C:H/I:H impact pair is severe: full database read exposes all case data, playbook configurations, stored credentials, and integration secrets, while write access allows data manipulation or destruction of SOAR workflow logic. No EPSS score was provided in the available data, so statistical exploitation probability cannot be quantified. KEV status is absent and no POC has been identified, indicating this has not yet been weaponized at scale. The primary real-world risk scenario is a malicious insider or an attacker who has already compromised an Automation Engineer account - this is not an opportunistic external attack path. The missing EPSS data is a gap that limits confidence in probability-based prioritization.

An authenticated user with the 'Automation Engineer' role crafts a malicious input within a Splunk SOAR playbook automation data API request, injecting SQL that escapes the intended query boundary. The injected payload executes against the SOAR backend database with application-level permissions, enabling the attacker to exfiltrate all case records, stored credentials, and integration configurations, or overwrite playbook logic to introduce persistent backdoor automation. No public POC has been identified, but the attack requires only standard SQL injection techniques applied to an authenticated API endpoint.