CVE-2026-76365: The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. in Splunk Splunk SOAR

Splunk SOAR versions below 8.6.0 contain a SQL injection vulnerability (CVE-2026-76365) that allows users with the Automation Engineer role to run arbitrary SQL statements against the internal database. The issue occurs because the custom list database lookup is built using the supplied list name directly in the SQL query instead of using bound parameters, enabling injection of malicious SQL code. This flaw enables unauthorized modification and access to all relevant data stored in the Splunk SOAR database.

An attacker with the Automation Engineer role can perform unauthorized create, read, update, and delete operations on the Splunk SOAR database. This compromises the confidentiality and integrity of the data stored in the system. The vulnerability does not affect availability. There are no known exploits in the wild at this time.

The vulnerability affects Splunk SOAR versions prior to 8.6.0. Users should upgrade to version 8.6.0 or later where this issue is fixed. Until then, restrict the Automation Engineer role to trusted users only. No official patch link was provided in the input; check Splunk's official advisories for the latest remediation guidance.