In Splunk Nmap Scanner versions =3.0, the scan network action in the connector's action manifest is classified as read-only, but it accepts script parameters that can perform write operations. This discrepancy allows users with appropriate playbook permissions in Splunk SOAR to run the scan network action in Safe Mode playbooks and potentially execute commands or modify target systems through Nmap Scripting Engine scripts. The vulnerability arises from improper permission specification of this security-critical resource.

An attacker with a role capable of editing, creating, or running playbooks in Splunk SOAR can exploit this vulnerability to execute commands or perform changes on target systems via Nmap Scripting Engine scripts. This could lead to limited confidentiality, integrity, and availability impacts on affected systems as indicated by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: Low).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided. Until a fix is available, restrict roles that can edit, create, or run playbooks to trusted users only and review playbook configurations to limit exposure.