CVE-2026-76372: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. in Splunk Nmap Scanner

In Splunk Nmap Scanner versions >=3.0 and <3.0.15, the scan network action is designated as read-only in the connector action manifest, but it accepts script parameters capable of write operations. Users with sufficient playbook permissions in Splunk SOAR can exploit this by running the scan network action in Safe Mode playbooks, potentially leading to command execution or modifications on target systems through Nmap Scripting Engine scripts. This is due to improper permission specification for this security-critical resource.

An attacker with a role that allows editing, creating, or running playbooks in Splunk SOAR can leverage this vulnerability to execute commands or perform unauthorized changes on target systems via the Nmap Scripting Engine. This could lead to partial confidentiality, integrity, and availability impacts on affected systems.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict roles that can edit, create, or run playbooks to trusted users only and monitor usage of the scan network action in playbooks.