Splunk SOAR EUVD-2026-62926

Requires a valid account with the 'Administrator' role in Splunk SOAR On-premises - this is not a default user role and must be explicitly assigned per Splunk's role-based access control model (documented at https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises). No special non-default configuration is required beyond having network access to the SOAR REST API - the vulnerable endpoint exists in default deployments. Exploitation is bounded by the SOAR instance's own network reachability; impact is limited to internal network enumeration (host/port discovery) with no direct path to data exfiltration, code execution, or integrity modification. Scope does not change (S:U), so the attacker cannot pivot to compromise other systems solely through this vulnerability.

The NVD-assigned CVSS score of 2.7 (Low) is appropriate and consistent with the actual risk profile. The PR:H metric is the dominant risk limiter: exploitation requires control of an Administrator-level account, which already grants extensive access to Splunk SOAR itself. The C:L impact reflects that an attacker gains only network topology information (host reachability, port status), not credential material or application data. No EPSS score is available in the provided data, but given the high privilege requirement and low confidentiality impact, a low EPSS would be expected. The vulnerability is not listed in CISA KEV, and no public proof-of-concept exploit code has been identified. The primary realistic threat is an insider threat scenario or post-compromise lateral reconnaissance by an attacker who has already obtained SOAR admin credentials. In environments that enforce strict SOAR admin account controls and MFA, residual risk is minimal.

An attacker who has obtained Splunk SOAR Administrator credentials - via phishing, credential stuffing, or lateral movement from a compromised SOC workstation - authenticates to the SOAR REST API and iterates through internal RFC-1918 address ranges and common port numbers using the /rest/support/connectivity/.../check_connectivity endpoint. The SOAR platform, which typically has broad internal network access to reach security tooling, acts as a proxy scanner, returning reachability status for each probe and mapping internal network segments otherwise unreachable from the attacker's position. No public exploit code is required given the simplicity of crafting the HTTP requests.