EUVD-2026-62937
GHSA-5x32-67q6-rxx3
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Playbook editor role constitutes high privileges (PR:H); scope changes to target systems where NSE scripts execute, with limited C/I/A across each dimension.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system through Nmap Scripting Engine scripts. The vulnerability is possible because the Nmap Scanner connector action manifest classifies the scan network action as read-only even though the action accepts script parameters that can perform write operations. For more information see Manage settings for a playbook in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/manage-settings-for-a-playbook-in-splunk-soar-cloud) in the Splunk documentation.
AnalysisAI
The Nmap Scanner connector for Splunk SOAR (versions prior to 3.0.15) permits privileged users to bypass Safe Mode playbook restrictions by exploiting a manifest miscategorization that marks the scan network action as read-only despite its accepting NSE script parameters capable of write operations and command execution on target systems. Users holding roles that allow editing, creating, or running playbooks can leverage this gap to run arbitrary Nmap Scripting Engine scripts against networked targets through SOAR automation - a meaningful privilege escalation given SOAR platforms typically have broad network reach. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Splunk SOAR user account holding a role that explicitly grants the ability to edit, create, or run playbooks - this is the stated prerequisite in the CVE description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) scores 6.6 and captures the key risk dynamics accurately: exploitation requires high privileges (PR:H - a SOAR role with playbook edit or run rights), but given those privileges, the attack is low-complexity and requires no further interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A Splunk SOAR user with a playbook editor or runner role creates or modifies a Safe Mode playbook to include the Nmap Scanner scan network action, configuring it with a malicious NSE script parameter - for example, one that writes a file or executes a command on the scanned target host. Because the connector manifest classifies scan network as read-only, SOAR's Safe Mode enforcement does not block the action, and Nmap executes the attacker-supplied script against the target system within the SOAR platform's network reach. … |
| Remediation | The primary remediation is to upgrade the Nmap Scanner connector for Splunk SOAR to version 3.0.15 or later, which corrects the action manifest classification for the scan network action. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today