CVE-2026-76406: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not. in Splunk Splunk SOAR

In Splunk SOAR versions before 8.7.0, an unauthenticated attacker with access to encrypted credential data can exploit a vulnerability in the REST API authentication process. The product decrypts Basic authentication values prior to completing authentication checks, enabling the attacker to expose and decrypt encrypted credentials. This behavior leaks security-relevant information about the state of the product and its encrypted data. The vulnerability requires the attacker to already have encrypted credential data from the instance, restricting exploitation to scenarios where such data is obtained by other means.

The vulnerability allows unauthorized disclosure of encrypted credential data by decrypting it through the REST API without proper authentication. This leads to a confidentiality breach of sensitive credentials stored in Splunk SOAR. However, the attack requires prior access to encrypted credential data, so it does not allow arbitrary unauthenticated access or compromise of the system without that prerequisite.

A fix is available in Splunk SOAR version 8.7.0 and later. Users should upgrade to version 8.7.0 or newer to remediate this vulnerability. Since this is an on-premises product, administrators should apply the official update from Splunk to address the issue. No other mitigations are indicated in the provided data.