Splunk SOAR EUVD-2026-62921

The Splunk SOAR Automation Broker notification endpoint must be reachable from the attacker's network position (AV:N confirms network-accessible deployment). The AC:H rating indicates the attacker must know or correctly identify the specific HTTP header and value that the broker accepts as proof of local-system origin - this is a non-trivial prerequisite requiring knowledge of the broker's trust logic, obtainable via source code inspection, Splunk documentation (the advisory references public Splunk docs on the Automation Broker), or enumeration. No authentication is required (PR:N) and no victim user interaction is needed (UI:N). Exploitation is concretely limited by: (1) attacker knowledge of the exact header name and expected loopback or host-IP value, (2) network reachability of the Automation Broker endpoint, and (3) the target running Splunk SOAR below version 8.6.0. Environments that firewall the Automation Broker endpoint to trusted subnets significantly reduce real-world exploitability despite the AV:N base vector.

The CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a meaningful moderating factor: AC:H indicates the attacker must correctly determine the specific header name and value accepted as local-origin proof, which requires source-code knowledge, reconnaissance, or trial-and-error rather than trivial guessing. No KEV listing and no POC are confirmed in the provided data, supporting a scheduled rather than emergency patch cadence for most organizations. However, PR:N and UI:N together mean no credentials or user interaction are required once the complexity hurdle is cleared, and the strategic value of a Splunk SOAR host - with its deep integrations into security tooling, credential stores, and automated response workflows - makes full C/I/A impact highly realistic upon successful exploitation. EPSS data was not included in the provided intelligence, so exploitation probability cannot be quantified numerically; the AC:H rating remains the primary signal moderating urgency. Defenders should weigh the blast radius of a compromised SOAR platform (lateral movement, playbook abuse, credential harvesting) as a threat multiplier beyond the base CVSS score alone.

An unauthenticated remote attacker with network access to the Automation Broker notification endpoint sends a crafted HTTP request with a forged source-IP header (e.g., X-Forwarded-For: 127.0.0.1 or the SOAR host's own address) that satisfies the broker's local-origin trust check. Because the broker evaluates this client-supplied header rather than the actual TCP source, the request is processed as locally originating, enabling execution of arbitrary code on the Splunk SOAR host. No public exploit code is identified at time of analysis, but CWE-290 header-spoofing techniques are well-documented and the required header value may be discoverable through source code review or Splunk documentation.