Splunk Soar CVE-2026-76527

Splunk SOAR deployments running any version below 8.7.0 expose files and directories to external parties (CWE-552), and

Cisco/Splunk has shipped a software hardening release for Splunk SOAR that fixes multiple internally discovered flaws, o

Severity signals and exploitation signals diverge here: Splunk SOAR deployments below 8.7.0 permit an authenticated low-

Remote code execution in Splunk SOAR versions below 8.6.0 allows unauthenticated remote attackers to execute arbitrary c

Arbitrary code execution in Splunk SOAR (On-premises) versions below 8.6.0 is reachable by any authenticated user regard

Information disclosure in Splunk SOAR On-premises (all versions below 8.7.0) allows any authenticated user holding the l

Improper TLS certificate validation in Splunk SOAR's CyberArk REST client exposes all credential vault traffic to interc

Splunk SOAR (On-premises) below 8.7.0 exposes authentication token values to authenticated users who hold the 'Users and

Path traversal in Splunk SOAR's Universal Forwarder credentials-package extraction allows an authenticated Administrator

Path traversal during app installation in Splunk SOAR On-premises below version 8.6.0 allows an authenticated user holdi

SQL injection in Splunk SOAR below version 8.6.0 enables users holding the "Automation Engineer" role to execute arbitra

SQL injection in Splunk SOAR's playbook automation data APIs grants any user holding the 'Automation Engineer' role unre