PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-76358 Splunk CVE debrief

A path traversal vulnerability exists in Splunk SOAR versions below 8.6.0, allowing a user with app-install privileges to write files outside the intended temporary directory during app installation. The vulnerability is due to the archive extraction routine not validating that extracted file paths stay within the intended destination directory. This issue can lead to unauthorized file overwrites or data corruption if exploited. The vulnerability requires app-install privileges, which limits its impact but still poses a significant risk. To mitigate this vulnerability, it is essential to review and limit app-install privileges to necessary personnel, monitor for unusual file writes, and upgrade to Splunk SOAR version 8.6.0 or later if possible. Additionally, reviewing app installation and configuration processes for security and implementing additional logging and monitoring for app installation activities can help prevent exploitation.

Vendor
Splunk
Product
Splunk SOAR
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-19
Original CVE updated
2026-08-21
Advisory published
2026-08-19
Advisory updated
2026-08-21

Who should care

Splunk SOAR administrators, security teams, and personnel with app-install privileges should be aware of this vulnerability and take necessary actions to mitigate it. They should review and limit app-install privileges, monitor for unusual file writes, and upgrade to Splunk SOAR version 8.6.0 or later if possible. Additionally, they should review app installation and configuration processes for security and implement additional logging and monitoring for app installation activities.

Technical summary

The vulnerability is a path traversal in the archive extraction routine of Splunk SOAR versions below 8.6.0. A user with app-install privileges could use this vulnerability to write files outside the intended temporary directory during app installation. This could potentially lead to unauthorized file overwrites or data corruption. The vulnerability is due to insufficient validation of extracted file paths.

Defensive priority

Medium priority due to the requirement for app-install privileges and the potential for file overwrite.

Recommended defensive actions

  • Review and limit app-install privileges to necessary personnel
  • Monitor for and restrict unusual file writes outside the temporary directory
  • Upgrade to Splunk SOAR version 8.6.0 or later
  • Review app installation and configuration processes for security
  • Implement additional logging and monitoring for app installation activities
  • Conduct a thorough review of current app installations for potential exposure
  • Verify and document the security of app installation processes

Evidence notes

Evidence from the NVD and Splunk advisory indicates a path traversal vulnerability in Splunk SOAR versions below 8.6.0. Limited details are available on exploitability and impact. The vulnerability allows a user with app-install privileges to write files outside the intended temporary directory during app installation. Further review of Splunk SOAR configurations and app installation processes is recommended.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T22:17:21.000Z and has not been modified since then.