CVE-2026-76364: The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. in Splunk Splunk SOAR

In Splunk SOAR versions below 8.6.0, the software builds database lookup queries by directly incorporating user-supplied names instead of using bound SQL parameters. This improper handling of input enables a user with the "Automation Engineer" role to perform SQL injection attacks through custom function results, potentially reading all relevant data stored in the Splunk SOAR database and compromising system integrity.

An attacker with the Automation Engineer role can execute arbitrary SQL commands on the Splunk SOAR database, leading to unauthorized disclosure of sensitive information and integrity impact. Availability is not affected. This elevates the risk of data exposure and undermines trust in the system's data handling.

A fix is available in Splunk SOAR version 8.6.0 and later. Users should upgrade to version 8.6.0 or above to remediate this vulnerability. No additional mitigation steps are indicated in the vendor advisory.