AD LDAP App (Splunk SOAR) CVE-2026-76373

The attacker must be authenticated to Splunk SOAR and hold a role that grants the 'run actions' permission - this is the sole but critical prerequisite. No administrator-level SOAR role is required; any user who can execute actions (including analyst-tier roles in many SOC deployments) is within scope. The vulnerability is triggered through the input fields of AD LDAP app actions, meaning the attacker must be able to invoke those specific actions either manually or via playbook. What limits exploitation: the requirement for valid SOAR credentials with 'run actions' permission prevents unauthenticated or fully external exploitation; an attacker who can only view dashboards or read cases but cannot run actions is not affected. The attack is also scoped to Active Directory objects accessible by the LDAP service account configured in the app - privileges of that service account bound what can be enumerated or modified.

The NVD-assigned CVSS 3.1 score of 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N accurately reflects the real-world risk profile: the vulnerability is network-reachable and requires no user interaction, but exploitation is gated behind valid SOAR credentials with 'run actions' permission, making mass exploitation unlikely. The C:L/I:L impact aligns with partial directory disclosure and constrained unintended write actions rather than full domain compromise. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. The absence of a CISA KEV listing and no known public exploit code further reduces near-term risk. The integrity vector (I:L) is worth noting: the ability to redirect account modification actions - such as disabling accounts or changing group memberships - to unintended AD objects could have outsized operational impact in active SOAR playbooks, even though CVSS scopes it as partial. Overall, this is a genuine medium-priority issue for organizations using this specific SOAR add-on, prioritized by the low exploitation complexity once access is established.

An authenticated Splunk SOAR user with a role that includes the 'run actions' permission manually invokes an AD LDAP action - such as a user lookup or group query - and injects crafted LDAP filter syntax into an input field (e.g., a username or distinguished name parameter). The injected filter alters the LDAP query scope to enumerate all accounts and groups in the directory or retrieves sensitive attributes (such as password hints or description fields) from arbitrary objects. In a more impactful scenario, the attacker manipulates a DN-based input to redirect an account modification action - intended for one object - to a privileged AD account or group, causing unintended directory changes. No public exploit code has been identified at time of analysis.