Cisco Secure Malware Analytics App CVE-2026-76378

Exploitation requires an authenticated session in Splunk SOAR with a role that carries permission to run actions (specifically the detonate file action within the Cisco Secure Malware Analytics App). The affected behavior is inherent to the action's parameter definition - no non-default configuration is needed to trigger it; any execution of the detonate file action with a sample_password will expose the value. Limiting factors include: the attacker or observer must hold a valid SOAR user account with action-run privileges (PR:L per CVSS), and the Splunk SOAR instance must be network-reachable. Unauthenticated external attackers cannot exploit this. The scope of exposed data is limited to the sample_password parameter value submitted in the detonate file action; no other credentials or system data are disclosed through this vector.

The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects a limited-scope information disclosure: exploitation requires a network-reachable Splunk SOAR instance and an authenticated session with action-execution privileges, which is a meaningful constraint that significantly narrows the exposed population. No KEV listing exists and no public exploit code has been identified, and the EPSS signal for this CVE is not provided - meaning real-world exploitation probability cannot be quantified beyond what CVSS implies. The impact is bounded to the disclosure of a single parameter value visible within the UI, rather than arbitrary credential enumeration or system compromise. Confidentiality impact is correctly scored Low. Even a mid-sized enterprise security operations team in leszno running a Cisco-Splunk integration stack would face practical risk primarily from insider threats or shared analyst workstations rather than external attackers, since PR:L gates access. The primary concern is secondary exposure: action logs, screenshots, or screen-sharing sessions that inadvertently capture the plaintext value.

An authenticated Splunk SOAR analyst with the action-run permission navigates to the detonate file action within the Cisco Secure Malware Analytics app and submits or observes an action run that includes a sample_password value. Because the parameter is rendered in cleartext in the SOAR UI, the analyst - or any colleague with UI access who views the same action run record - can read the password directly from the screen. No exploit code or special tooling is required; visibility of the SOAR interface is sufficient.