EUVD-2026-62922
GHSA-gwcv-h3gc-ghjv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Arbitrary code execution warrants C:H/I:H/A:H; PR:L reflects that a role-less account suffices; AV:N and AC:L confirmed by REST API access with no special conditions.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Lifecycle Timeline
3DescriptionCVE.org
In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the Representational State Transfer (REST) API and execute arbitrary code. The vulnerability is possible because the REST API does not require an assigned role for the request and does not restrict the user-supplied file path to the intended temporary directory. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Splunk SOAR (On-premises) security information (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/introduction-to-splunk-soar-on-premises/splunk-soar-on-premises-security-information) in the Splunk documentation.
AnalysisAI
Arbitrary code execution in Splunk SOAR (On-premises) versions below 8.6.0 is reachable by any authenticated user regardless of role assignment, via a crafted file path submitted to the REST API. The REST API endpoint neither enforces role-based access control nor restricts the user-supplied path to the intended temporary directory, enabling path traversal (CWE-22) that culminates in code execution on the SOAR server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated account on the Splunk SOAR (On-premises) instance - specifically, the CVSS PR:L vector confirms low-privilege authentication is sufficient, and the description explicitly states that 'no role assigned' accounts are vulnerable, meaning role enforcement provides no protection. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H scores 7.6 and assigns only low confidentiality and integrity impact despite the description explicitly stating arbitrary code execution is possible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who possesses any valid Splunk SOAR account - including a provisioned-but-unassigned service account or a test account never assigned a role - authenticates to the SOAR instance and submits a REST API request containing a crafted file path with traversal sequences such as '../../'. Because the API neither checks for an assigned role nor confines the path to the intended temporary directory, the traversal succeeds and the server processes or executes the attacker-specified file, resulting in arbitrary code execution under the SOAR process context. … |
| Remediation | The primary fix is to upgrade Splunk SOAR (On-premises) to version 8.6.0 or later, per the vendor advisory SVD-2026-0804 at https://advisory.splunk.com/advisories/SVD-2026-0804. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Splunk SOAR instances and versions, and audit current SOAR account provisioning to understand which users have access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today