CVE-2026-76363: The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. in Splunk Splunk SOAR

In Splunk SOAR versions below 8.6.0, the application improperly handles user-supplied input in database queries used by playbook automation data APIs. This lack of proper neutralization enables users assigned the Automation Engineer role to execute arbitrary SQL statements against the underlying database, potentially modifying or accessing all stored data. The issue arises from the failure to sanitize special elements that can alter the intended logic of SQL queries.

An attacker with Automation Engineer privileges can perform unauthorized SQL operations, including creating, reading, updating, or deleting any data in the Splunk SOAR database. This can lead to data compromise or manipulation, impacting confidentiality and integrity. Availability is not affected according to the CVSS vector.

The vulnerability affects Splunk SOAR versions prior to 8.6.0. Users should upgrade to version 8.6.0 or later where this issue is resolved. Since no explicit patch link or vendor advisory is provided, verify the availability of an official fix from Splunk. Until patched, restrict Automation Engineer role assignments to trusted users only.