Splunk SOAR EUVD-2026-62930

Exploitation requires the attacker to hold the explicitly granted "Automation Engineer" Splunk SOAR role - this role must be assigned by an administrator and is not available to standard or read-only users. The specific vulnerable operation is the custom list retrieval feature invoked from within a SOAR playbook; the attacker must have the ability to create or modify playbooks and define a custom list with an injected name. Exploitation is constrained by: (1) the "Automation Engineer" role requirement - no path exists for lower-privileged or unauthenticated users; (2) the injection point is specifically the list name field during playbook-triggered lookups, not general playbook execution; (3) database availability impact is not achievable via this vector. Environments where the Automation Engineer role is tightly controlled and audited, or where playbook creation is subject to peer review, face substantially reduced practical risk beyond what the raw CVSS score conveys.

The CVSS 6.5 (Medium) score with PR:H accurately captures the privilege barrier: exploitation requires the "Automation Engineer" role, which must be explicitly granted by an administrator and is not held by default users. Once that role condition is met, complexity is low (AC:L) and no user interaction is needed (UI:N), making exploitation straightforward for any SQL-literate attacker. The dual C:H/I:H impact represents a near-total compromise of SOAR database contents - credentials, playbook logic, case data, audit trails - which is severe for a platform central to security operations. The A:N rating is consistent with CRUD-focused injection. No KEV listing and no known POC reduce the urgency tier below actively exploited vulnerabilities, but organizations where the Automation Engineer role is broadly assigned face materially higher risk than the medium CVSS score alone suggests. EPSS data was not provided in the input; without it, exploit probability relative to the broader CVE population cannot be quantified. The primary risk-limiting factor is the role prerequisite - environments with strict role governance are meaningfully more protected.

An attacker with legitimate access to a Splunk SOAR instance who has been granted the "Automation Engineer" role crafts a playbook that references a custom list whose name contains a SQL injection payload - for example, a UNION-based query to extract stored credentials or API tokens from the SOAR database. When the playbook runs, Splunk SOAR inserts the malicious list name unsanitized into a SQL statement, causing the injected query to execute against the backend database and return sensitive data to the attacker or silently modify records such as audit logs or playbook definitions. No public POC has been identified, but the technique is well-understood and requires only basic SQL injection knowledge once role access is established.