This vulnerability in Splunk SOAR (versions below 8.6.0) stems from the CyberArk REST client failing to validate server certificates by default. An attacker capable of intercepting or altering network traffic between Splunk SOAR and the CyberArk REST server can exploit this to access or modify all relevant data exchanged via the credential manager. The attack requires network-path interception capability and does not require authentication. The vulnerability is tracked as CVE-2026-76362 with a CVSS 3.1 score of 7.4 (high severity).

Successful exploitation allows an unauthenticated attacker with network interception capability to access or modify sensitive credential data exchanged between Splunk SOAR and the CyberArk REST server. This compromises confidentiality and integrity of credential management data, potentially leading to unauthorized access to protected resources. There is no indication of availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider securing the network path between Splunk SOAR and the CyberArk REST server to prevent interception, such as using VPNs or network segmentation. Review and follow the Splunk documentation on managing credentials with a password vault for best practices.