CVE-2026-76373: The software constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component. in Splunk AD LDAP app for Splunk SOAR

In the AD LDAP app for Splunk SOAR versions 2.3 and >=2.3 <2.3.8, LDAP queries are constructed using input from upstream components without proper neutralization of special LDAP elements. This allows users with action execution permissions to perform LDAP injection attacks, enabling enumeration of Active Directory objects such as accounts, groups, and organizational units, reading sensitive attributes from arbitrary directory objects, and redirecting account modification actions to unintended targets.

An attacker with the ability to run actions can exploit this vulnerability to enumerate Active Directory objects, access sensitive directory attributes, and manipulate account modification actions to affect unintended objects. This could lead to unauthorized information disclosure and potential unauthorized modifications within Active Directory. The CVSS score is 5.4 (medium severity), reflecting limited confidentiality and integrity impacts without availability impact.

A fixed version is available starting from version 2.3.8. Users should upgrade the AD LDAP app for Splunk SOAR to version 2.3.8 or later to remediate this vulnerability. No additional mitigation steps are indicated in the provided data.