CVE-2026-76386: The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere. in Splunk Zoom app for Splunk SOAR
CVE-2026-76386 affects the Zoom app for Splunk SOAR versions below 3.2.2. The vulnerability allows users with permission to run actions to see meeting and personal meeting ID passwords in cleartext within the user interface. This occurs because the app does not mask the affected password parameters, exposing sensitive information. The issue is limited to the create meeting, update meeting, and update user settings actions. The CVSS score is 4.3, indicating a medium severity level.
AI Analysis
Technical Summary
In versions below 3.2.2 of the Zoom app for Splunk SOAR, password parameters (password and pmi_password) used in certain actions are not masked and are displayed in cleartext in the user interface. This allows users with action execution permissions to view sensitive meeting credentials. The vulnerability arises because these parameters are not marked as passwords within the app, leading to unintended information disclosure. The affected actions include create meeting, update meeting, and update user settings.
Potential Impact
Users with roles that permit running actions can inadvertently access sensitive meeting passwords in cleartext. This exposure could lead to unauthorized access to Zoom meetings if the credentials are misused. However, the impact is limited to confidentiality as there is no indication of integrity or availability impact. The vulnerability requires user privileges to run actions, reducing the risk to lower-privileged users.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict action execution permissions to trusted users only. Monitor vendor communications for updates regarding a patch or official fix for this issue.
CVE-2026-76386: The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere. in Splunk Zoom app for Splunk SOAR
Description
CVE-2026-76386 affects the Zoom app for Splunk SOAR versions below 3.2.2. The vulnerability allows users with permission to run actions to see meeting and personal meeting ID passwords in cleartext within the user interface. This occurs because the app does not mask the affected password parameters, exposing sensitive information. The issue is limited to the create meeting, update meeting, and update user settings actions. The CVSS score is 4.3, indicating a medium severity level.
CVSS v3.1
Score 4.3medium
Affected software
pkg:github/splunk/zoom-app-for-splunk-soarRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In versions below 3.2.2 of the Zoom app for Splunk SOAR, password parameters (password and pmi_password) used in certain actions are not masked and are displayed in cleartext in the user interface. This allows users with action execution permissions to view sensitive meeting credentials. The vulnerability arises because these parameters are not marked as passwords within the app, leading to unintended information disclosure. The affected actions include create meeting, update meeting, and update user settings.
Potential Impact
Users with roles that permit running actions can inadvertently access sensitive meeting passwords in cleartext. This exposure could lead to unauthorized access to Zoom meetings if the credentials are misused. However, the impact is limited to confidentiality as there is no indication of integrity or availability impact. The vulnerability requires user privileges to run actions, reducing the risk to lower-privileged users.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict action execution permissions to trusted users only. Monitor vendor communications for updates regarding a patch or official fix for this issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- cisco
- Date Reserved
- 2026-08-19T12:02:03.631Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a862260acd9273b49a7046d
Added to database: 08/19/2026, 21:38:40 UTC
Last enriched: 08/19/2026, 21:54:27 UTC
Last updated: 08/19/2026, 22:12:18 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.