Splunk SOAR EUVD-2026-62923

Exploitation requires an authenticated user session in Splunk SOAR On-premises with the app-install privilege explicitly assigned - this is a non-default, administrator-granted role permission, not a capability available to standard analyst accounts. The vulnerability is triggered exclusively through the app installation workflow (upload and extraction of an archive via the SOAR interface), as documented at https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-apps-and-assets/add-and-configure-apps-and-assets-to-provide-actions-in-splunk-soar-on-premises. The CVSS vector confirms PR:H (high privileges required) and AV:N (network-accessible once authenticated). Limiting factors: the attacker must already possess authenticated high-privilege access; the deployment must be On-premises (Cloud edition is not in scope per available CPE data); and the scope is unchanged (S:U), meaning impact is contained to the SOAR host itself rather than propagating to adjacent systems.

CVSS 6.5 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H accurately captures the key risk dimensions: the attack is network-reachable (AV:N) and requires no user interaction (UI:N), but mandates high privileges (PR:H), which substantially narrows the realistic threat population to compromised admin accounts, malicious insiders, or privilege-escalation chains. The integrity and availability impact scores are both High - a successful file write to a critical system path could overwrite binaries, configuration files, or scheduled tasks, potentially enabling persistent code execution or service disruption. No CISA KEV listing and no public exploit code have been identified in the provided intelligence, placing exploitation status at 'no public exploit identified at time of analysis'; EPSS data was not supplied, so probability cannot be quantified numerically. Organizations with strict role hygiene - where the app-install permission is granted only to a small number of trusted administrators - face a materially lower realistic risk than the raw CVSS score implies. The absence of a confidentiality impact (C:N) is consistent with the description, which focuses entirely on file write rather than data exfiltration.

An attacker who has compromised a Splunk SOAR administrator account with the app-install role, or a malicious insider holding that permission, crafts a ZIP archive containing entries with path traversal sequences (e.g., '../../etc/cron.d/backdoor') pointing outside the staging directory. The archive is submitted through the standard SOAR app-installation web interface over the network, and the extraction routine writes the malicious payload to the traversed destination path on the host. Depending on the SOAR process's operating system privileges and the target path chosen, the outcome ranges from overwriting application files (availability impact) to planting a cron job or SSH authorized_keys entry for persistent host-level code execution (integrity impact).