CVE-2026-76407: The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor. in Splunk Splunk SOAR

CVE-2026-76407 concerns improper access control in Splunk SOAR, where the software does not correctly restrict access to resources from unauthorized users. This vulnerability was discovered internally by Cisco and is part of a broader set of issues addressed in a security hardening release. The flaw is classified under CWE-284, which relates to access control weaknesses. The affected versions include all releases from version 0 up to but excluding 8.7.0. There is no public CVSS score or evidence of exploitation in the wild at this time.

The vulnerability allows unauthorized actors to access resources that should be restricted, potentially leading to unauthorized information disclosure or actions within Splunk SOAR. However, no active exploitation has been reported, and the impact depends on the specific resource access granted by the flaw.

A software hardening release addressing this vulnerability has been issued by Cisco. Users should upgrade to Splunk SOAR version 8.7.0 or later to remediate this issue. Since the vendor advisory indicates a fix is available, applying the official update is the recommended mitigation.