Splunk SOAR CVE-2026-76406

Exploitation requires the attacker to already possess encrypted credential data exfiltrated from the affected Splunk SOAR (on-premises) instance; the vendor explicitly states the unauthenticated user cannot exploit this at will. The specific trigger is submitting those encrypted values as HTTP Basic authentication data to the Splunk SOAR REST API, which decrypts the Basic auth value before completing authentication checks, turning the API into a decryption oracle. The limiting factors that reduce real-world risk: the dependency on prior access to the encrypted credential store (reflected in CVSS AC:H), applicability only to SOAR on-premises versions below 8.7.0, and impact limited to confidentiality of credentials already in the attacker's possession in encrypted form. No non-default feature toggle is named - the flaw is in how the REST API processes Basic authentication.

This is a moderate-severity information-disclosure flaw (CVSS 5.9, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) whose real-world risk is substantially constrained by its own preconditions despite the network, unauthenticated attack vector. The single most important signal is AC:H combined with the vendor's own statement that 'the unauthenticated user should not be able to exploit the vulnerability at will': the attack is a decryption oracle that only works if the attacker ALREADY possesses encrypted credential data exfiltrated from the affected SOAR instance, so this is a post-compromise amplifier rather than a standalone initial-access bug. No EPSS score, no CISA KEV entry, and no public exploit were provided in the input, so exploitation status is 'no public exploit identified at time of analysis' and there is no evidence of active exploitation. No SSVC decision data was supplied. The confidentiality-only impact (C:H, I:N, A:N) is real and serious because decrypted SOAR credentials can unlock downstream systems (SOAR stores credentials for integrated tools), but the requirement to first obtain the encrypted blobs means prioritization should be elevated only where an attacker could plausibly already have read access to the credential store. Net: a genuine but conditional high-confidentiality issue, not a drop-everything internet-facing emergency; patch on a normal-to-prompt cycle and treat as high priority if SOAR credential data may already be exposed.

An attacker who has already obtained encrypted credential blobs from a Splunk SOAR instance below 8.7.0 (for example via a prior database read, backup theft, or insider access) submits those encrypted values as HTTP Basic authentication data to the SOAR REST API. Because SOAR decrypts the Basic auth value before completing authentication checks, the API acts as a decryption oracle and returns or exposes the plaintext credentials. No public proof-of-concept was provided in the input.