Webex SOAR App CVE-2026-76379

Exploitation requires an authenticated Splunk SOAR user who holds a role explicitly granting permission to run actions on the Cisco Webex App integration. The disclosure occurs only when the 'schedule meeting' action is invoked and a meeting password is supplied - the flaw is isolated to this specific action parameter and does not affect other Webex App actions or other SOAR integrations. Users without the 'run actions' role cannot trigger the exposure. External unauthenticated network access does not enable exploitation. The risk is further limited to environments where the Cisco Webex App for Splunk SOAR is installed and where meeting passwords are actually used; organizations that do not password-protect Webex meetings are not exposed to credential theft via this vector.

The vendor-supplied CVSS 4.3 (Medium) vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects the constrained scope: attack vector is network, but PR:L confirms exploitation requires an authenticated SOAR user already holding action-execution permissions, making this an insider or over-privileged-user scenario rather than an external attack surface. Confidentiality impact is limited to a single meeting credential (C:L), with no integrity or availability consequence. There is no CISA KEV listing, no identified public exploit code, and no EPSS data was provided - exploitation probability is therefore inferred as low. Real-world risk is further reduced by the niche deployment footprint of SOAR platforms and the role-gated access model. The primary threat model is accidental exposure (e.g., screen sharing, audit log review) or deliberate exfiltration by an insider with SOAR action permissions. This is a genuine but low-priority finding unless meeting passwords protect high-sensitivity sessions.

An authenticated Splunk SOAR user with the 'run actions' role opens the Cisco Webex App integration and triggers the 'schedule meeting' action, supplying a meeting password in the password parameter. Because the parameter is not masked, the plaintext credential is visible in the SOAR action form and may also appear in action run logs or audit records, allowing the user - or anyone with access to those logs - to capture the meeting credential and use it to join a protected Webex meeting without authorization. No public exploit code has been identified.