CVE-2026-76362: The software does not validate, or incorrectly validates, a certificate. in Splunk Splunk SOAR

In Splunk SOAR versions prior to 8.6.0, the CyberArk REST client fails to verify server certificates, enabling a man-in-the-middle attacker who can intercept network traffic between Splunk SOAR and the CyberArk REST server to access or modify all data exchanged via the credential manager. This vulnerability requires network-path interception capability and affects the confidentiality and integrity of the data but does not impact availability. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity.

An attacker capable of intercepting or modifying network traffic between Splunk SOAR and the configured CyberArk REST server can gain unauthorized access to or modify all relevant credential data exchanged. This compromises the confidentiality and integrity of sensitive credential information managed by Splunk SOAR, potentially leading to further unauthorized access or manipulation within the environment.

Splunk SOAR versions below 8.6.0 are affected. Users should upgrade to version 8.6.0 or later where this issue is addressed. Since the vulnerability is due to lack of certificate validation by default, enabling proper certificate validation or using secure network channels (e.g., VPN, TLS with strict validation) can mitigate the risk. Patch status is not explicitly confirmed in the provided data; therefore, check Splunk's official advisory or documentation for current remediation guidance.