As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76530 are related to use of non-canonical URL paths for authorization decisions and are grouped under the Common Weakness Enumeration (CWE) CWE-647.
CVE-2026-76529 is a vulnerability in Splunk SOAR where the product does not sufficiently protect all possible user access paths to restricted functionality or resources. This issue relates to improper protection of alternate paths, categorized under CWE-424. The vulnerability affects versions prior to 8.7.0. Cisco addressed this issue as part of a broader internal security review and software hardening release.
CVE-2026-76528 is a vulnerability in Splunk SOAR where the product fails to use or incorrectly uses a protection mechanism, resulting in insufficient defense against directed attacks. This issue was identified during Cisco's internal security review and is categorized under CWE-693, which relates to protection mechanism failures. The vulnerability affects Splunk SOAR versions from 0 up to but not including 8.7.0. No CVSS score is provided, and there is no indication of known exploits in the wild.
CVE-2026-76527 is a vulnerability in Splunk SOAR where the software does not properly anticipate or handle exceptional conditions that rarely occur during normal operation. This issue relates to improper checks or handling of exceptional conditions, categorized under CWE-703. The vulnerability affects versions from 0 up to but not including 8.7.0. Cisco addressed this issue as part of an internal security review resulting in a software hardening release. No CVSS score is provided, and there are no known exploits in the wild.
CVE-2026-76526 affects Splunk SOAR versions prior to 8.7.0 and involves improper neutralization of structured messages or data. The product does not ensure or incorrectly ensures that these messages are well-formed and meet certain security properties before processing. Cisco addressed this issue as part of a software hardening release following an internal security review.
CVE-2026-76408 is a vulnerability in Splunk SOAR involving improper control of a resource throughout its lifecycle, categorized under CWE-664. It affects versions from 0 up to but not including 8.7.0. Cisco identified this issue during an internal security review and addressed it in a software hardening release. No CVSS score or public exploit information is available for this vulnerability.
CVE-2026-76407 is an improper access control vulnerability in Splunk SOAR that allows unauthorized actors to access restricted resources. This issue was identified during Cisco's internal security review and addressed in a software hardening release. The vulnerability is categorized under CWE-284, indicating insufficient access restrictions. It affects Splunk SOAR versions from 0 up to but not including 8.7.0. No CVSS score is available, and no known exploits are reported in the wild.
CVE-2026-76406 affects Splunk SOAR versions prior to 8.7.0. It allows an unauthenticated user who already has access to encrypted credential data from the affected instance to submit Basic authentication data to the REST API and decrypt that data. This occurs because Splunk SOAR decrypts Basic authentication values before completing authentication checks. Exploitation requires possession of encrypted credential data, limiting the vulnerability's ease of exploitation.
CVE-2026-76308 affects Splunk SOAR versions prior to 8.7.0, where an authenticated user can change the Enterprise Security edition license via the REST API without proper authorization checks. This vulnerability arises because Splunk SOAR authenticates requests but fails to verify the caller's authorization before applying license changes.
In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer authentication token values for other users. If the inferred token grants administrative access, that user could gain administrative access to the Splunk SOAR instance.
The vulnerability is possible because the REST API accepts caller-controlled query filters on sensitive user record fields.
For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/6.4.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.
CVE-2026-76306 is a vulnerability in Splunk SOAR versions prior to 8.7.0 where users with the 'Observer' role can infer password hashes and authorization tokens of other users via REST API query filters. This occurs because the product applies query filters before protecting sensitive fields, leading to unauthorized information disclosure.
CVE-2026-76305 is a vulnerability in Splunk SOAR versions prior to 8.7.0 where an authenticated user without the appropriate role permission to view apps can download an archive of an installed app. This flaw occurs because the software does not perform an authorization check before returning the app archive, potentially exposing proprietary source code and sensitive information contained within the app archive.
CVE-2026-76304 affects Splunk SOAR versions prior to 8.7.0. It allows an authenticated user without the required Automation Broker edit permission to download the Automation Broker Docker Compose configuration file. This file contains sensitive information such as the URL of the Splunk SOAR instance, container image location, and Automation Broker version. The vulnerability exists because the software does not enforce authorization checks when serving this configuration file.
In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could store attacker-controlled content that Splunk SOAR displays in app documentation by installing an app. If another user who holds a role with permission to view apps opens the app documentation, Splunk SOAR could run that content in the browser of the user who opened the app documentation. With this access, the first user could access data and make changes that the user who opened the app documentation could make.
The vulnerability is possible because Splunk SOAR does not sanitize app documentation content before it displays that content.
The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user that holds a role with the install_apps capability should not be able to exploit the vulnerability at will.
For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/7.1.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Add and configure apps and assets to provide actions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.6.0/manage-your-splunk-soar-on-premises-apps-and-assets/add-and-configure-apps-and-assets-to-provide-actions-in-splunk-soar-on-premises) in the Splunk documentation.
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76302 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.
CVE-2026-76301 is a vulnerability in Splunk Enterprise involving improper or missing protection mechanisms that fail to adequately defend against directed attacks. Cisco identified this issue during an internal security review and addressed it with a software hardening release. The vulnerability relates to weakness CWE-693, which concerns insufficient protection mechanisms. Multiple versions of Splunk Enterprise prior to specific patch versions are affected.
CVE-2026-76300 is a vulnerability in Splunk Enterprise involving improper control of a resource throughout its lifecycle, categorized under CWE-664. It affects multiple versions of Splunk Enterprise prior to specific patch releases. Cisco identified this issue during an internal security review and addressed it in a software hardening release. No CVSS score or exploit in the wild is currently reported.
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76299 are related to improper access control and are grouped under the Common Weakness Enumeration (CWE) CWE-284.
In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user account running Splunk Enterprise on search head cluster members.
The vulnerability is possible because the PostgreSQL sidecar service derives a privileged database password from the search head cluster identifier that appears in search job logs.
For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), server.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/configuration-file-reference/10.2.0-configuration-file-reference/server.conf), and Sidecar configuration settings (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.
CVE-2026-76297 affects Splunk Enterprise versions prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16. It allows an unauthenticated attacker to trick a user with the edit_federated_providers capability into disabling all federated search providers via a crafted GET request. This can temporarily disrupt federated searches from accessing remote datasets. Exploitation requires phishing the privileged user to initiate the request in their browser. The vulnerability arises because the REST API accepts state-changing actions via GET requests.