Splunk SOAR CVE-2026-76366

A valid Splunk SOAR user account is required (CVSS PR:L confirmed). The attacker must have network access to the Splunk SOAR REST API endpoint. No elevated privileges, administrator role, or special configuration is needed beyond possessing any authenticated account on the target instance. Exploitation is limited to users who already hold a legitimate credential - external unauthenticated attackers cannot exploit this directly. Additionally, the value of exploitation scales with the privilege differential between the attacker's account and the target user's account; if all accounts in an instance hold equivalent permissions, the practical data exposure is limited to what the attacker could already access. No non-default feature or deployment mode is required; the playbook run REST API endpoint is standard functionality.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N accurately captures the risk profile: network-reachable, low complexity, requiring only a valid user account. The high confidentiality impact reflects that session tokens, once recovered, grant the attacker equivalent access to all data visible to the victim within the SOAR platform - a meaningful lateral-privilege escalation in environments where analysts hold different data permissions. There is no KEV listing and no confirmed public exploit, which moderates urgency somewhat, but the low attack complexity means that even a mid-sized security operations team in gniezno deploying a shared Splunk SOAR instance should treat this as an urgent patch cycle rather than routine maintenance, since any compromised account can silently escalate to another's session. EPSS data was not included in the intelligence provided; without it, exploitation probability cannot be precisely quantified, but the authenticated-only prerequisite is the primary limiting factor keeping real-world risk from being rated higher.

An attacker with a low-privilege Splunk SOAR account authenticates to the REST API and issues crafted GET requests to the Run Playbook endpoint, embedding filter expressions that probe for session token field values belonging to a higher-privileged analyst. By iterating filter values and observing whether results are returned or suppressed, the attacker reconstructs the target's session token through a filter-oracle technique, then replays that token to assume the victim's session and access all data and playbook results visible to that account.