Splunk SOAR EUVD-2026-62922

Exploitation requires a valid authenticated account on the Splunk SOAR (On-premises) instance - specifically, the CVSS PR:L vector confirms low-privilege authentication is sufficient, and the description explicitly states that 'no role assigned' accounts are vulnerable, meaning role enforcement provides no protection. The attacker must have network access to the SOAR REST API endpoint (AV:N, AC:L). No specific playbook, feature flag, or non-default configuration is required; the REST API endpoint is present in all affected versions by default. Exploitation is limited to the on-premises deployment model - cloud-hosted instances are not confirmed vulnerable. The key limiting factor is possession of any valid SOAR account: environments with strict account lifecycle management (no dormant or role-less accounts) face meaningfully reduced risk, since the attack cannot proceed without credentials.

The official CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H scores 7.6 and assigns only low confidentiality and integrity impact despite the description explicitly stating arbitrary code execution is possible. This is a notable inconsistency: arbitrary code execution on a SOAR server should yield C:H/I:H at minimum, since an attacker controlling the SOAR engine can read playbook credentials, pivot to integrated security tools, and disrupt incident response workflows. The A:H rating is consistent with code execution but C:L/I:L appear to understate the actual blast radius. PR:L correctly reflects that only a valid account (with no role) is required, which is a realistic low bar in many enterprise environments where service or test accounts exist. No EPSS score was provided in the source data; KEV status is negative, and no public POC has been identified. The Cisco-reported origin and the ENISA EUVD listing (EUVD-2026-62922) indicate the issue has received multi-organization review. Real-world priority should be elevated above the 7.6 score suggests due to the low authentication bar and the high-value nature of SOAR infrastructure in enterprise SOC environments.

An attacker who possesses any valid Splunk SOAR account - including a provisioned-but-unassigned service account or a test account never assigned a role - authenticates to the SOAR instance and submits a REST API request containing a crafted file path with traversal sequences such as '../../'. Because the API neither checks for an assigned role nor confines the path to the intended temporary directory, the traversal succeeds and the server processes or executes the attacker-specified file, resulting in arbitrary code execution under the SOAR process context. No public proof-of-concept has been identified, but the attack requires only HTTP access and valid credentials, making independent rediscovery straightforward.