AD LDAP App CVE-2026-76374

Exploitation requires a valid Splunk SOAR account with a role that explicitly grants permission to run actions - this is a non-default, administratively assigned privilege, not available to all SOAR users. The AD LDAP App must be installed, configured, and connected to an Active Directory environment within the SOAR instance. The attacker must actively trigger write operations through the app (e.g., by executing a lookup or query action), which then causes AD response data to be logged. A secondary condition for data retrieval is access to the persistent debug log file, either directly on the SOAR host filesystem or via a downstream log pipeline. The CVSS PR:L metric confirms authentication is required; unauthenticated exploitation is not possible. Limiting factors include: requirement for an SOAR account with action-execution permissions (not all users), requirement for the AD LDAP app to be installed and in use, and requirement for access to log storage to retrieve the exposed data.

The CVSS 4.3 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately characterizes the exploitation profile: network-accessible, low complexity, requiring only a low-privileged authenticated SOAR account, with limited confidentiality impact and no integrity or availability consequences. No EPSS score was provided in the available intelligence data, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, making opportunistic mass exploitation unlikely at this time. The real-world risk, however, should not be dismissed purely on the basis of the 4.3 score: Active Directory data - user attributes, group memberships, privileged account details - is exactly the reconnaissance material adversaries seek during post-compromise lateral movement. An organization relying on Splunk SOAR for security operations and AD integration should treat this as a moderate-priority remediation item, particularly given that log files may flow into downstream log management or SIEM systems where the exposure widens.

An authenticated Splunk SOAR user with a role granting action-execution permissions triggers an AD LDAP app action - such as a user lookup or group membership query - as part of a playbook or manual action run. The app processes the LDAP response and writes the returned AD data to a persistent debug log file. The same user, or a separate actor who gains access to the log storage location, then reads the log to harvest Active Directory details such as privileged account names, group structures, or user attributes useful for lateral movement planning.