Splunk SOAR CVE-2026-76530

Exploitation requires an authenticated low-privilege account on the Splunk SOAR web interface (CVSS PR:L), with no user interaction needed (UI:N) and network reachability to the application (AV:N). The specific prerequisite is the ability to submit requests whose URL path is non-canonical (e.g. alternately encoded or structured) such that the component making the authorization decision evaluates a different path than the one actually serviced - CWE-647 - thereby bypassing access control. Affected deployments are Splunk SOAR versions below 8.7.0; upgrading to 8.7.0 removes the exposure. The limiting factor is the authentication requirement: an attacker must first possess valid (even minimal) SOAR credentials, so this is not exploitable by a fully anonymous remote attacker. The exact request syntax that triggers the bypass is not described in the available sources.

Severity signals and exploitation signals diverge here. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is high and consistent with an authorization-bypass flaw (CWE-647) that yields total impact - the SSVC Technical Impact of 'total' aligns with the C:H/I:H/A:H rating. However, the exploitation-pressure signals are low: SSVC records Exploitation 'none' and Automatable 'no', there is no CISA KEV listing, no EPSS score was supplied, and no public exploit or PoC reference appears in the input. Critically, the CVSS vector requires PR:L, so this is NOT an unauthenticated remote flaw - an attacker must already hold a valid low-privilege Splunk SOAR account, which meaningfully narrows the realistic threat to insiders or attackers who have already obtained credentials. The vuln.today priority of 'this_week' reflects this balance: a genuine, vendor-confirmed and patched high-severity issue worth remediating promptly, but not an emergency and showing no evidence of active or automatable mass exploitation. In short, this is a real priority driven by impact and the availability of a fix, not by exploitation activity. Note: EPSS data is absent, so probabilistic exploitation likelihood cannot be compared against the other signals.

An attacker holding a valid low-privilege account on the Splunk SOAR web interface sends crafted requests containing non-canonical URL paths (e.g. encoded or alternate path encodings) so that the authorization layer evaluates a different path than the one ultimately served, bypassing access controls to reach resources or actions beyond their privilege level. No public exploit code or PoC reference was identified in the available sources, and the precise request format that triggers the bypass is not described in the vendor advisory summary.