EUVD-2026-62939
GHSA-jrh7-gp79-87r9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network vector as SOAR is accessed remotely; PR:L because an authenticated account with action-execution permission is required; C:L for partial AD data disclosure; no integrity or availability impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
AnalysisAI
Sensitive Active Directory response data exposure in the AD LDAP App for Splunk SOAR (versions below 2.3.8) allows authenticated users holding action-execution permissions to cause AD directory data to be written to a persistent debug log file. The flaw is rooted in CWE-532 (insertion of sensitive information into log files) and is reachable over the network by any low-privileged SOAR user with the appropriate role. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Splunk SOAR account with a role that explicitly grants permission to run actions - this is a non-default, administratively assigned privilege, not available to all SOAR users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately characterizes the exploitation profile: network-accessible, low complexity, requiring only a low-privileged authenticated SOAR account, with limited confidentiality impact and no integrity or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Splunk SOAR user with a role granting action-execution permissions triggers an AD LDAP app action - such as a user lookup or group membership query - as part of a playbook or manual action run. The app processes the LDAP response and writes the returned AD data to a persistent debug log file. … |
| Remediation | Upgrade the AD LDAP App for Splunk SOAR to version 2.3.8 or later, which resolves the debug log exposure per Splunk advisory SVD-2026-0806 (https://advisory.splunk.com/advisories/SVD-2026-0806). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today