CVE-2026-76371: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. in Splunk FireAMP

In Splunk FireAMP versions >=2.1 and <2.1.15, the add listitem action in the FireAMP connector is incorrectly classified as read-only in the action manifest, even though it modifies file lists. This misclassification permits users with appropriate playbook permissions in Splunk SOAR to perform unauthorized modifications to file lists by running the add listitem action in a Safe Mode playbook. The vulnerability arises from the discrepancy between the action's manifest classification and its actual behavior.

The vulnerability allows users with roles that can edit, create, or run playbooks in Splunk SOAR to make unauthorized changes to file lists in FireAMP. The impact is limited to integrity (I:L) with no confidentiality or availability impact. The CVSS score is 2.7 (low severity), indicating limited risk and requiring high privileges to exploit.

No explicit patch or remediation is stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should review and restrict roles that can edit, create, or run playbooks in Splunk SOAR to trusted personnel until an official fix is available.