AD LDAP App CVE-2026-76375

Exploitation requires three concurrent conditions: (1) the attacker must hold an authenticated Splunk SOAR account with a role that grants permission to run actions - anonymous and unprivileged accounts without action-execution roles cannot trigger the credential dump; (2) the AD LDAP app must be installed and configured at a version below 2.3.8, meaning LDAP credentials must be provisioned in the connector configuration; (3) the attacker must be able to read the persistent debug log file produced by the connector process, either via SOAR's log-viewing interface or direct filesystem access. Exploitation is bounded by CVSS PR:L - it is not a zero-authentication attack. The scope change (S:C) applies only after credential extraction: the SOAR exploitation is low-impact in isolation, but the obtained AD credentials create downstream risk against the Active Directory environment, which is the true high-value target.

The vendor-assigned CVSS 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) captures the key risk dynamics: network-reachable, low privilege required, no user interaction, and scope-changed confidentiality impact. The PR:L requirement is the primary risk limiter - exploitation is confined to SOAR users who hold a role with action-execution permissions, which in a mature security operations environment should be a controlled group but is not necessarily small. The S:C designation elevates the practical risk above the numeric score suggests: exposed LDAP bind credentials or service account secrets can be leveraged against the Active Directory environment, potentially enabling lateral movement, privilege escalation, or persistent access across the enterprise. No EPSS data was provided in the intelligence feed; however, given no KEV listing and no public POC, opportunistic exploitation appears unlikely. The more realistic threat is insider abuse or a compromised low-privilege SOAR account. There is no conflicting data between the CVSS vector and the description - both consistently indicate authenticated, low-privilege, network-delivered exploitation.

An authenticated Splunk SOAR user with a role that includes action-execution permissions navigates to the AD LDAP connector and triggers any available action (such as a user lookup or test connectivity). The connector process writes its full environment - including LDAP bind credentials or service account secrets stored as environment variables - to a persistent debug log file on the SOAR host. The attacker then reads the log file (assuming they have filesystem or SOAR log-access permissions) and extracts the plaintext credentials, which can subsequently be used to authenticate directly to the Active Directory environment. No public POC exists, but the technique requires only standard SOAR UI interaction.