In versions below 2.4.5 of the Cisco Secure Malware Analytics app for Splunk SOAR, a user who holds a role with permission to run actions could… (CVE-2026-76378)

The vulnerability (CVE-2026-76378) affects Cisco Secure Malware Analytics app for Splunk SOAR versions prior to 2.4.5. It allows users with roles authorized to run actions to view the sample_password parameter in cleartext during the detonate file action. The root cause is the failure to mark the sample_password parameter as a password, resulting in unmasked display and potential exposure of sensitive credentials. The CVSS 3.1 score is 4.3 (medium severity), reflecting a network attack vector with low complexity and requiring privileges but no user interaction, impacting confidentiality only.

An attacker or user with permission to run actions can obtain sensitive password information in cleartext, potentially compromising confidentiality. There is no impact on integrity or availability. No known exploits are reported in the wild.

Upgrade to version 2.4.5 or later of the Cisco Secure Malware Analytics app for Splunk SOAR where this issue is fixed. Patch status is not explicitly confirmed in the provided data, but the version boundary indicates the fix is in 2.4.5. Until upgrading, restrict roles with permission to run actions to trusted users only.