Splunk SOAR EUVD-2026-107639

Requires a valid low-privilege authenticated account on a Splunk SOAR instance (CVSS PR:L), reachable over the network (AV:N), running a version before 8.7.0; the vulnerability is fixed in 8.7.0. The specific product feature, input vector, or configuration that triggers the CWE-707 improper-neutralization flaw is not described in the available sources (Cisco/Splunk boilerplate advisory). Limiting factors: exploitation is gated by authentication (no anonymous/unauthenticated path per the vector), and only Splunk SOAR deployments below 8.7.0 are affected; no user interaction is required (UI:N).

Signals are moderate and internally consistent toward a non-emergency-but-do-not-ignore posture. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L) that yields high confidentiality, integrity and availability impact - i.e. an authenticated user can fully compromise the component. However, the exploitation-probability signals are weak: EPSS is 0.17% (6th percentile), there is no CISA KEV listing, and no public exploit or PoC reference is provided, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', not act_now or emergency, which aligns with the low EPSS and absence of active exploitation. Net: this is a genuinely high-severity-if-reached issue (full CIA impact behind authentication) but currently low real-world exploitation pressure - prioritize patching on a near-term maintenance cadence rather than as a fire-drill. Two data caveats: (1) the Description is Cisco's generic internal-hardening boilerplate and does not describe the trigger or mechanism, so the nature of the 'improper neutralization' (CWE-707) is unverified; (2) the Description names Cisco while the affected product, CPE and advisory are all Splunk SOAR - this is consistent with Cisco's ownership of Splunk rather than a mislabel, but the vendor advisory (SVD-2026-1011) should be read for specifics.

An attacker holding a valid low-privilege account on a Splunk SOAR instance running a version before 8.7.0 submits crafted, improperly neutralized input to the affected component over the network, triggering the CWE-707 flaw to gain full read/write control and impact availability of the component. No public exploit or PoC is identified, and the exact trigger is not described in the available sources. The AV:N/AC:L profile means that, once authenticated, the attack is network-reachable and low-complexity.