CVE-2026-76359 Splunk CVE debrief

Who should care

Splunk SOAR administrators and users with the Administrator role should be aware of this vulnerability and take steps to patch or mitigate it. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Additionally, they should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for exposed systems while remediation is scheduled and verified. They should also check relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence is documented. Affected operators, platforms, and security teams should prioritize patching to prevent potential path traversal attacks. Vulnerability management and security teams should also be aware of the potential impact on their systems and take steps to mitigate it. Asset inventory and configuration management teams should review their systems to ensure they are not exposed to this vulnerability. Monitoring and incident response teams should be prepared to detect and respond to potential attacks exploiting this vulnerability. Source tracking and incident response teams should also be aware of the potential impact on their systems and take steps to mitigate it. Rollback and change window management teams should plan for potential changes to their systems. Compensating controls and mitigation strategies should be reviewed and implemented where necessary. The CVE record was published on 2026-08-19T22:17:21.130Z and has not been modified since then. The NVD entry is currently Analyzed. For more information see Manage roles and permissions in Splunk SOAR (On-premises) and Configure forwarders to send SOAR data to your Splunk deployment in the Splunk documentation. This vulnerability has a CVSS score of 6.5 and a severity of MEDIUM. The CVSS score and severity are based on the CVSS v3.0 scoring system. The vulnerability is a path traversal vulnerability in the Universal Forwarder installer's archive extraction. The vulnerability is caused by a lack of verification for archive member The

Technical summary

In Splunk SOAR versions below 8.6.0, a user with the Administrator role can exploit a path traversal vulnerability in the Universal Forwarder installer's archive extraction. This allows writing files outside the intended installation directory due to a lack of verification for archive member destinations. The vulnerability is possible because the Universal Forwarder credentials-package extraction workflow does not verify that each archive member remains within the intended destination before extraction.

Defensive priority

Administrators of Splunk SOAR versions below 8.6.0 should prioritize patching to prevent potential path traversal attacks.

Recommended defensive actions

• Patch Splunk SOAR to version 8.6.0 or later
• Restrict Universal Forwarder installer access to trusted administrators
• Monitor for unusual file system changes
• Verify installation directory integrity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability exists in Splunk SOAR versions below 8.6.0, allowing an Administrator role user to use path traversal in the Universal Forwarder installer's archive extraction to write files outside the intended installation directory. Evidence is based on official CVE and NVD records. Defenders should verify installation directory integrity and monitor for unusual file system changes.

Official resources