CVE-2026-76373: The software constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component. in Splunk AD LDAP app for Splunk SOAR
CVE-2026-76373 is a medium severity vulnerability in the AD LDAP app for Splunk SOAR versions equal to 2.3. A user with permission to run actions can inject crafted input into LDAP queries, potentially enumerating Active Directory objects, reading sensitive attributes, and redirecting account modification actions to unintended objects.
AI Analysis
Technical Summary
The AD LDAP app for Splunk SOAR versions =2.3 contains an LDAP injection vulnerability where externally-influenced input is used to construct LDAP queries without proper neutralization of special elements. This allows users with action execution permissions to manipulate LDAP queries, leading to enumeration of directory objects, unauthorized reading of sensitive attributes, and redirection of account modification actions to unintended targets.
Potential Impact
An attacker with appropriate permissions can enumerate Active Directory objects including accounts, groups, and organizational units, read sensitive attributes from arbitrary directory objects, and redirect account modification actions to unintended objects. This could lead to information disclosure and unauthorized modifications within Active Directory environments.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict permissions to run actions in the AD LDAP app to trusted users only to reduce risk.
CVE-2026-76373: The software constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component. in Splunk AD LDAP app for Splunk SOAR
Description
CVE-2026-76373 is a medium severity vulnerability in the AD LDAP app for Splunk SOAR versions equal to 2.3. A user with permission to run actions can inject crafted input into LDAP queries, potentially enumerating Active Directory objects, reading sensitive attributes, and redirecting account modification actions to unintended objects.
CVSS v3.1
Score 5.4medium
Affected software
pkg:github/splunk/ad-ldap-app-for-splunk-soarRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The AD LDAP app for Splunk SOAR versions =2.3 contains an LDAP injection vulnerability where externally-influenced input is used to construct LDAP queries without proper neutralization of special elements. This allows users with action execution permissions to manipulate LDAP queries, leading to enumeration of directory objects, unauthorized reading of sensitive attributes, and redirection of account modification actions to unintended targets.
Potential Impact
An attacker with appropriate permissions can enumerate Active Directory objects including accounts, groups, and organizational units, read sensitive attributes from arbitrary directory objects, and redirect account modification actions to unintended objects. This could lead to information disclosure and unauthorized modifications within Active Directory environments.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict permissions to run actions in the AD LDAP app to trusted users only to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- cisco
- Date Reserved
- 2026-08-19T12:02:03.630Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a86225dacd9273b49a70419
Added to database: 08/19/2026, 21:38:37 UTC
Last enriched: 08/19/2026, 22:09:08 UTC
Last updated: 08/19/2026, 22:41:16 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.