In Splunk SOAR versions prior to 8.6.0, a stored XSS vulnerability exists due to improper sanitization of user-controllable input in notes. A user holding the "Incident Commander" role can embed JavaScript code in a note, which executes in the browser context of other users when they open the note. This occurs because the application treats existing note content as HTML without neutralizing potentially malicious scripts when the note format changes. Exploitation requires social engineering to induce the victim to load the malicious note. The vulnerability is rated medium severity (CVSS 4.0) with network attack vector, high attack complexity, high privileges required, and user interaction needed.

Successful exploitation allows execution of arbitrary JavaScript in the context of another user's browser session, potentially leading to information disclosure or session manipulation within the Splunk SOAR environment. However, the attacker must have the "Incident Commander" role to inject the script and must trick the victim into viewing the malicious note. There is no indication of privilege escalation or direct system compromise. The impact is limited to confidentiality and integrity at the user session level.

No official patch or fix is currently documented for this vulnerability. Since the vulnerability requires a user with the "Incident Commander" role to inject malicious scripts and social engineering to trick victims, organizations should review and restrict role assignments to trusted users only. Monitor and control note content changes and educate users about phishing risks. Check the vendor advisory regularly for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.