EUVD-2026-107634
GHSA-prj9-h2w8-2p78
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged SOAR account
-
DeliverySend crafted network request
-
ExploitReach externally-accessible file/directory
-
ExecutionCross privilege/scope boundary
-
ImpactDisclose or alter sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling File access restriction
MITRE ATT&CK
2 techniques across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to a Splunk SOAR instance running a version below 8.7.0, plus a low-privileged authenticated account (CVSS PR:L); no user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific product feature, API endpoint, or configuration that exposes the files/directories is not described in the available sources (generic CWE-552 bundled advisory), so the exact trigger is unverified. Limiting factors: exploitation is not possible by a fully unauthenticated attacker per the vector, SSVC marks it not automatable, and upgrading to Splunk SOAR 8.7.0 remediates it. |
| Impact | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes a network-reachable, low-complexity flaw requiring only low-level authentication, with a scope change and total confidentiality/integrity/availability impact. The SSVC framework agrees on the severity of outcome (Technical Impact: total) but reports Exploitation: none and Automatable: no, meaning CISA's data shows no observed exploitation and no evidence it can be automated. There is no CISA KEV listing and no EPSS score in the supplied data, and no PoC or exploit reference is present, so exploitation status is: no public exploit identified at time of analysis. This creates a genuine tension: the vuln.today Decision label is act_now (driven largely by the 9.9 total-impact rating and the authenticated-but-network vector), yet the exploitation signals (SSVC none, no KEV, no PoC) point to a high-severity-but-not-yet-exploited issue. The practical read is that this is a high-priority patch because of impact and ease of exploitation once an attacker has any foothold, not because of confirmed active exploitation - prioritize per the act_now label while recognizing the exploitation evidence is currently absent rather than confirmed. Note also that the description is a generic bundled-hardening notice under CWE-552 and does not describe the actual trigger, so the mechanism behind the CVSS metrics is not independently verifiable from the sources. |
| Exploit ScenarioDerived | A low-privileged authenticated user of a Splunk SOAR deployment (for example a holder of a limited analyst or API account) sends crafted requests over the network to reach files or directories that should not be externally accessible, abusing the CWE-552 weakness to read or manipulate sensitive data across a trust boundary (scope change). No user interaction is required. No public exploit code is identified at the time of analysis, and the exact trigger is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Splunk SOAR deployments running any version below 8.7.0 expose files and directories to external parties (CWE-552), and the vendor rates the issue at CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning a network-reachable attacker holding only a low-privileged authenticated account can reach the exposed resources with no user interaction, with high confidentiality, integrity and availability impact and a scope change beyond the vulnerable component. The flaw was found during Cisco's internal security review and shipped in a bundled software hardening release rather than as a single documented bug, so the precise endpoint or feature that exposes the files is not described in the available sources. SSVC records no known exploitation and marks the issue not automatable, and no public exploit code or proof-of-concept was identified at time of analysis; the vendor-prioritised decision is act now, with upgrading to 8.7.0 as the remediation.
RemediationAI
Vendor-released patch: upgrade Splunk SOAR to 8.7.0 or later, which the assessment confirms remediates the issue; the fixed version and full affected-version matrix are documented in Splunk advisory SVD-2026-1011 (https://advisory.splunk.com/advisories/SVD-2026-1011). Because the CVSS vector requires network reachability and a low-privileged authenticated account (AV:N/PR:L) while SSVC marks the issue not automatable, interim compensating controls can reduce exposure between the advisory and the maintenance window: restrict management and API reachability to the SOAR instance from trusted network segments or administrative ranges only, at the cost of breaking integrations and automation callbacks that originate elsewhere; and inventory and tighten low-privileged SOAR accounts and their role assignments, since the assessed prerequisite is any authenticated low-privilege user, at the cost of re-validation work for playbook service accounts. Monitoring file-access and download activity from low-privileged sessions on the SOAR server provides detection coverage but does not close the exposure, and the available sources do not describe any vendor-supplied workaround beyond updating.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-552 ('Files or Directories Accessible to External Parties') describes a class of access-control failure in which filesystem resources that should remain internal to the application are reachable from outside its intended trust boundary. In Splunk SOAR - the security orchestration, automation and response platform that runs playbooks, connectors and app containers - such resources would typically sit behind the platform's web and API surface, and the accompanying tags (Information Disclosure, Path Traversal) indicate the exposure direction is toward disclosure rather than upload. The CPE cpe:2.3:a:splunk:splunk_soar:*:*:*:*:*:*:*:* confirms the affected component is the SOAR server itself, not a bundled third-party app. The CVSS scope change (S:C) indicates that successful exploitation is assessed to affect resources beyond the vulnerable component, which is consistent with a file-exposure primitive that can reach host-level content. Importantly, this CVE is one entry in a consolidated Cisco hardening advisory covering multiple internally discovered issues; the advisory does not map CVE-2026-76531 to a specific feature, API endpoint or configuration, so the exact trigger and the precise set of exposed paths remain unverified from the available sources.
Know when Splunk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network vector with low-privilege authentication (PR:L) and no user interaction per vendor data; CWE-552 cross-boundary file access supports S:C with total C/I/A impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
3DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76531 are related to files or directories accessible to external parties and are grouped under the Common Weakness Enumeration (CWE) CWE-552.
Executive ViewAI
Splunk SOAR deployments older than 8.7.0 carry a critical file-exposure flaw that lets any low-privileged authenticated user reach files and directories they should never see, with high impact on confidentiality, integrity, and availability. Because access requires only a basic account, this affects the broader set of internal users, contractors, and service accounts with SOAR access rather than just administrators, and successful abuse could expose sensitive automation data or enable manipulation of security workflows. Leadership should care because SOAR sits at the center of security operations, so compromise here risks both sensitive data loss and disruption of incident response.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
Exploit-DB