EUVD-2026-62940
GHSA-44mh-ph29-xgxx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Action invoked over SOAR network UI (AV:N, AC:L); action-execution role required (PR:L); AD credentials in log extend impact beyond SOAR boundary (S:C, C:L).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
AnalysisAI
Credential exposure in the AD LDAP app for Splunk SOAR (versions below 2.3.8) allows any authenticated user holding an action-execution role to trigger a full connector process environment dump to a persistent plaintext debug log file, disclosing sensitive credentials such as LDAP bind secrets or service account tokens. The CVSS scope-changed vector (S:C) reflects that the exposed credentials extend impact beyond the SOAR platform itself to the underlying Active Directory environment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the attacker must hold an authenticated Splunk SOAR account with a role that grants permission to run actions - anonymous and unprivileged accounts without action-execution roles cannot trigger the credential dump; (2) the AD LDAP app must be installed and configured at a version below 2.3.8, meaning LDAP credentials must be provisioned in the connector configuration; (3) the attacker must be able to read the persistent debug log file produced by the connector process, either via SOAR's log-viewing interface or direct filesystem access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) captures the key risk dynamics: network-reachable, low privilege required, no user interaction, and scope-changed confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Splunk SOAR user with a role that includes action-execution permissions navigates to the AD LDAP connector and triggers any available action (such as a user lookup or test connectivity). The connector process writes its full environment - including LDAP bind credentials or service account secrets stored as environment variables - to a persistent debug log file on the SOAR host. … |
| Remediation | Upgrade the AD LDAP app for Splunk SOAR to version 2.3.8 or later, which resolves the credential exposure via the debug log. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today