CVE-2026-76307 Splunk CVE debrief

Who should care

Splunk SOAR administrators and users with the Users and Roles view permission should assess their exposure and verify the versions of Splunk SOAR in their environment. They should review and manage roles and permissions to prevent unauthorized access and monitor REST API usage for suspicious activity. Additionally, they should consider compensating controls for exposed systems and review relevant monitoring, detection, and logs for exposed assets.

Why it matters

Defenders should care about CVE-2026-76307 because it allows users with specific permissions to infer authentication tokens, potentially leading to unauthorized administrative access. Splunk SOAR administrators and users with the Users and Roles view permission should assess their exposure, verify versions, and manage roles and permissions to prevent exploitation.

• Potential unauthorized administrative access to Splunk SOAR instances.
• Possible lateral movement or escalation of privileges.
• Need for verification of Splunk SOAR versions and role configurations.
• Potential for sensitive information disclosure.

Technical summary

The vulnerability exists in Splunk SOAR versions below 8.7.0, where users with the Users and Roles view permission can use the REST API to infer authentication token values for other users. This can lead to administrative access if the inferred token has administrative privileges. The REST API accepts caller-controlled query filters on sensitive user record fields, allowing potential unauthorized access. There is no information on public exploitation or specific attack vectors used in the wild. Affected users should verify their Splunk SOAR versions and manage roles and permissions accordingly.

Defensive priority

Defenders should prioritize verifying the versions of Splunk SOAR in their environment and ensuring that roles and permissions are properly managed.

Recommended defensive actions

• Verify Splunk SOAR versions in your environment and ensure they are updated to 8.7.0 or later.
• Review and manage roles and permissions to prevent unauthorized access.
• Monitor REST API usage for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide information about the vulnerability, but details about exploitation or victim impact are not available. The vulnerability exists in Splunk SOAR versions below 8.7.0, where users with the Users and Roles view permission can use the REST API to infer authentication token values for other users. This is possible because the REST API accepts caller-controlled query filters on sensitive user record fields. There is no information on public exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.