In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the… (CVE-2026-76367)

In Splunk SOAR versions prior to 8.6.0, a stored XSS vulnerability (CVE-2026-76367) exists where users with the "Incident Commander" role can embed JavaScript in notes. When another user views the note, the script executes in their browser due to improper sanitization of note content treated as HTML during format changes. This vulnerability requires user interaction via phishing to trigger the malicious script. The CVSS 3.1 score is 4.0 (medium), reflecting network attack vector, high attack complexity, high privileges required, user interaction needed, and partial impact on confidentiality and integrity.

An attacker with the "Incident Commander" role can inject malicious JavaScript into notes, which executes in the browsers of other users who view those notes. This can lead to partial confidentiality and integrity impacts within the Splunk SOAR environment. However, exploitation requires phishing to trick users into triggering the script, and the attacker cannot exploit the vulnerability arbitrarily. There are no known exploits in the wild.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the "Incident Commander" role to trusted users only and educate users to be cautious of unexpected notes. Monitor vendor communications for updates regarding patches or official mitigations.