EUVD-2026-62925
GHSA-qx47-vg36-72pm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Any authenticated account regardless of role (PR:L) can reach the network-exposed REST endpoint (AV:N); low confidentiality impact reflects operational telemetry exposure without credentials or secrets; no integrity or availability impact applies.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health endpoint to gather system and cluster telemetry that should be restricted to administrative or support users. The vulnerability is a missing authorization check, where the endpoint does not verify that the caller holds a role permitted to view system health and cluster state. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Monitor the health of your Splunk SOAR (On-premises) system (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-system-health-and-performance/monitor-the-health-of-your-splunk-soar-on-premises-system) in the Splunk documentation.
AnalysisAI
Unauthorized information disclosure in Splunk SOAR (On-premises) below version 8.6.0 exposes system health and cluster telemetry to any authenticated user, including those with no assigned role, via the /rest/health REST endpoint. The root cause is a missing authorization check (CWE-862) that validates session authentication but omits role-membership verification before returning restricted operational data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Splunk SOAR account, confirmed by PR:L in the CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N vector - specifically, the flaw is triggered even when that account has no role assigned, making it accessible to the widest possible set of authenticated identities including provisioned-but-unconfigured accounts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately reflects the bounded risk profile: the endpoint is network-reachable with low complexity, but exploitation requires an authenticated account and produces only a low-severity confidentiality impact with no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding any valid Splunk SOAR credential - obtained via phishing, credential stuffing, or as a low-privileged insider account with no assigned role - authenticates to the platform and issues a direct HTTP GET to /rest/health. Because no role validation occurs, the endpoint returns cluster health data and system telemetry, which the attacker uses to enumerate node counts, service status, and infrastructure topology to inform subsequent lateral movement or privilege escalation. … |
| Remediation | Upgrade Splunk SOAR (On-premises) to version 8.6.0 or later, which introduces the missing authorization check on the /rest/health endpoint; full details are available in vendor advisory SVD-2026-0804 at https://advisory.splunk.com/advisories/SVD-2026-0804. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today