In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could inject crafted input into… (CVE-2026-76373)

CVE-2026-76373 is an injection vulnerability in the AD LDAP app for Splunk SOAR versions prior to 2.3.8. Users with roles that permit running actions can inject crafted input into Active Directory queries. This injection enables enumeration of Active Directory objects such as accounts, groups, and organizational units, unauthorized reading of sensitive attributes from arbitrary directory objects, and the redirection of account modification actions to unintended objects. The vulnerability is classified under CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query).

An attacker with permission to run actions can exploit this vulnerability to enumerate sensitive Active Directory information, read sensitive attributes from directory objects, and potentially redirect account modification actions. This could lead to unauthorized disclosure of directory information and unintended modifications within Active Directory. There is no indication of availability impact or known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions below 2.3.8, upgrading to version 2.3.8 or later is likely the intended remediation. Until an official fix is confirmed, restrict action execution permissions to trusted users only.