CVE-2026-76360 Splunk CVE debrief

Who should care

Administrators and users of Splunk SOAR versions below 8.6.0 should be aware of this vulnerability and take necessary actions to restrict access to the /rest/health endpoint and verify role configurations. Affected operator, platform, vulnerability-management, and security-team impact indicate that security teams should review and restrict access to the /rest/health endpoint, verify role configurations for administrative or support users, and monitor system health and cluster state for unauthorized access. This vulnerability affects Splunk SOAR versions below 8.6.0, and operators should update Splunk SOAR to version 8.6.0 or later. Vulnerability management teams should review compensating controls for exposed systems while remediation is scheduled and verified. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. This vulnerability affects security teams that manage Splunk SOAR deployments and operators that use Splunk SOAR for security monitoring and incident response. Security teams should implement compensating controls to restrict access to system telemetry. Security teams should check relevant monitoring, detection, and logs for exposed assets that need extra review. Security teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Security teams should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. This vulnerability affects platform security teams that manage Splunk SOAR deployments and operators that use Splunk SOAR for security monitoring and incident response. Vulnerability management teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. This vulnerability affects security teams that manage Splunk SOAR deployments and operators that use Splunk SOAR for security monitoring and incident response. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified. Security teams should track exceptions, retest remediated assets, and close the item only

Technical summary

The vulnerability is a missing authorization check in the /rest/health endpoint of Splunk SOAR versions below 8.6.0. This allows authenticated users with no role assigned to gather system and cluster telemetry that should be restricted to administrative or support users. The CVSS score is 4.3, and the CWE weakness is CWE-862. Affected product context indicates that Splunk SOAR versions below 8.6.0 are vulnerable. Defensive impact suggests that verify role configurations and restrict access to health endpoints.

Defensive priority

Authenticated users without roles could access restricted system and cluster telemetry in Splunk SOAR versions below 8.6.0. Verify role configurations and restrict access to health endpoints.

Recommended defensive actions

• Review and restrict access to the /rest/health endpoint
• Verify role configurations for administrative or support users
• Monitor system health and cluster state for unauthorized access
• Update Splunk SOAR to version 8.6.0 or later
• Implement compensating controls to restrict access to system telemetry

Evidence notes

The vulnerability is a missing authorization check in the /rest/health endpoint of Splunk SOAR versions below 8.6.0, allowing authenticated users with no role assigned to gather system and cluster telemetry. Official records indicate a CVSS score of 4.3 and a CWE-862 weakness. Evidence limits suggest that defenders should verify role configurations and restrict access to health endpoints. The source grounding indicates that this issue affects Splunk SOAR versions below 8.6.0.

Official resources