CVE-2026-76380 affects the CrowdStrike OAuth API app for Splunk SOAR versions 5.1 and 5.1.x prior to 5.1.3. The vulnerability involves the exposure of a sensitive document password in cleartext within the user interface when running specific actions (detonate file or detonate url). This occurs because the document_password parameter is not masked, allowing users with permission to run actions to see the password. The issue is due to the app not marking this parameter as a password type.
CVE-2026-76379 affects the Cisco Webex app for Splunk SOAR versions 2.2 and 2.2.x prior to 2.2.1. The vulnerability allows users with permission to run actions to see sensitive meeting passwords in cleartext when using the schedule meeting action. This occurs because the password parameter is not masked in the user interface, leading to potential information disclosure.
CVE-2026-76378 is a medium severity vulnerability in the Cisco Secure Malware Analytics app for Splunk SOAR versions 2.4 up to but not including 2.4.5. The vulnerability arises because the sample_password parameter used in the detonate file action is not masked and is displayed in cleartext in the user interface. This allows users with permission to run actions to potentially view sensitive passwords. The issue is due to the app not marking this parameter as a password field.
CVE-2026-76377 affects the Azure AD Graph app for Splunk SOAR versions 2.5 and earlier than 2.5.3. The vulnerability allows users with permission to run actions to see a sensitive password in cleartext because the temp_password parameter in the reset password action is not masked in the user interface. This occurs because the app does not designate this parameter as a password type. The issue is classified as medium severity with a CVSS score of 4.3. A patch is available to address this vulnerability.
CVE-2026-76376 affects the AWS IAM app for Splunk SOAR versions before 2.1.9. The vulnerability allows users with permission to run actions to see sensitive AWS credentials in cleartext because the credentials parameter is not masked in the user interface. This occurs because the app does not designate the parameter as a password field. The issue is classified as medium severity with a CVSS score of 4.3. A patch is available to address this information disclosure.
CVE-2026-76375 affects the AD LDAP app for Splunk SOAR versions 2.3 and from 2.3 up to but not including 2.3.8. In these versions, a user with permission to run actions can cause sensitive credentials to be written in plaintext to a persistent debug log file by invoking a specific action. This exposure arises because the full connector process environment is logged, potentially revealing sensitive information. The vulnerability has a medium severity with a CVSS score of 5. No known exploits are reported in the wild. The issue is fixed in version 2.3.8 or later.
CVE-2026-76374 affects the AD LDAP app for Splunk SOAR versions before 2.3.8. It allows users with permission to run actions to cause sensitive Active Directory response data to be written to persistent debug log files. This exposure could reveal sensitive user information or provide guidance to an attacker. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-76373 affects the AD LDAP app for Splunk SOAR versions 2.3 and from 2.3 up to but not including 2.3.8. It allows a user with permission to run actions to inject crafted input into LDAP queries, potentially enumerating Active Directory objects, reading sensitive attributes, and redirecting account modification actions to unintended objects. The vulnerability arises from improper neutralization of special elements in LDAP queries constructed from externally influenced input.
CVE-2026-76372 affects the Splunk Nmap Scanner connector in versions 3.0 up to but not including 3.0.15. The vulnerability arises because the scan network action is incorrectly marked as read-only, despite accepting script parameters that can perform write operations. This misclassification allows users with roles that can edit, create, or run playbooks in Splunk SOAR to execute commands or make changes on target systems via Nmap Scripting Engine scripts when running the scan network action in Safe Mode playbooks.
CVE-2026-76371 is a low-severity vulnerability in Splunk FireAMP versions 2.1 and from 2.1 up to but not including 2.1.15. It involves improper permission specification for a security-critical resource, where the add listitem action is incorrectly marked as read-only despite modifying file lists. This allows users with roles that can edit, create, or run playbooks in Splunk SOAR to make unauthorized changes to file lists via a Safe Mode playbook.
CVE-2026-76370 is a medium-severity vulnerability in Splunk SOAR versions prior to 8.6.0. It allows an authenticated user with restricted tenant access to bypass role-based tenant restrictions via the REST API, enabling them to view tenant names and identifiers outside their authorized scope in multi-tenant deployments. This occurs because the software does not correctly enforce authorization checks when returning tenant information through the REST API.
CVE-2026-76369 is a low-severity path traversal vulnerability in Splunk SOAR versions prior to 8.6.0. It allows a user with the OnPrem Broker role to write files outside the intended Automation Broker log directory by exploiting insufficient sanitization of crafted filenames during log uploads.
CVE-2026-76368 is a low-severity vulnerability in Splunk SOAR versions prior to 8.6.0 where users with the playbooks:view permission can view metadata about playbook repositories they are not authorized to access. This occurs because the Playbook History feature does not verify repository permissions before returning playbook revision metadata.
CVE-2026-76367 is a stored Cross-Site Scripting (XSS) vulnerability in Splunk SOAR versions below 8.6.0. It allows a user with the "Incident Commander" role to store JavaScript in a note, which executes in the browser of another user viewing that note. The vulnerability arises because note content can be treated as HTML without proper sanitization when the note format changes. Exploitation requires tricking the victim user into initiating a request in their browser. This vulnerability has a medium severity rating and a CVSS score of 4.0.
CVE-2026-76366 is a medium severity vulnerability in Splunk SOAR versions before 8.6.0. It allows a user with a valid account to exploit REST API filtering on playbook runs to retrieve session tokens. These tokens can expose all data accessible to the affected user. The issue arises because the REST API does not properly block filters from matching values that should be hidden in responses. This vulnerability affects versions prior to 8.6.0.
CVE-2026-76365 is a SQL injection vulnerability in Splunk SOAR versions prior to 8.6.0. A user with the Automation Engineer role can execute arbitrary SQL commands against the Splunk SOAR database via custom list retrieval in playbooks. This allows unauthorized create, read, update, and delete operations on database data. The vulnerability arises because the software improperly constructs SQL queries using externally supplied list names without proper parameterization.
CVE-2026-76364 is a SQL injection vulnerability in Splunk SOAR versions prior to 8.6.0. A user with the "Automation Engineer" role can execute arbitrary SQL queries against the Splunk SOAR database via custom function results. This occurs because the software constructs SQL commands using externally influenced input without proper neutralization, allowing unauthorized reading of sensitive data and impacting system integrity.
CVE-2026-76363 is a vulnerability in Splunk SOAR versions prior to 8.6.0 where users with the Automation Engineer role can execute arbitrary SQL queries against the application's database. This occurs because user input is not properly neutralized in database queries within playbook automation data APIs, allowing unauthorized creation, reading, updating, or deletion of data. The vulnerability has a medium severity rating with a CVSS score of 6.5.
CVE-2026-76362 affects Splunk SOAR versions below 8.6.0. The vulnerability arises because the CyberArk REST client integrated with Splunk SOAR does not validate server certificates by default. An unauthenticated attacker with network interception capabilities between Splunk SOAR and the CyberArk REST server could access or modify sensitive data exchanged through the credential manager. This flaw requires the attacker to be able to observe or alter network traffic. The vulnerability has a high severity rating with a CVSS score of 7.4.