CVE-2026-76367: The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. in Splunk Splunk SOAR

In Splunk SOAR versions prior to 8.6.0, a stored XSS vulnerability exists due to improper neutralization of user-controllable input in notes. A user with the "Incident Commander" role can embed JavaScript in a note, which executes in the browser of another user who views the note. The root cause is that Splunk SOAR treats existing note content as HTML without sanitizing it when the note format changes. Exploitation requires social engineering to induce the victim to load the malicious note content. The vulnerability is limited by the requirement of the attacker having the Incident Commander role and the need for user interaction.

Successful exploitation could allow an attacker with the Incident Commander role to execute arbitrary JavaScript in the context of another user's browser session when they view a crafted note. This could lead to limited confidentiality and integrity impacts such as theft of session information or manipulation of the user interface. The CVSS vector indicates network attack vector, high attack complexity, high privileges required, user interaction required, and impacts on confidentiality and integrity but not availability.

No explicit patch or fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the Incident Commander role to trusted users only and educate users about phishing risks to reduce the likelihood of exploitation. Monitor official Splunk advisories for updates and apply patches promptly once released.