CVE-2026-76363 Splunk CVE debrief

Who should care

Organizations using Splunk SOAR versions below 8.6.0, particularly those with users holding the 'Automation Engineer' role, should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to a fixed version, restricting 'Automation Engineer' role privileges, monitoring database queries for suspicious activity, and implementing additional security controls to prevent data tampering. Managed environments with Splunk SOAR deployments should confirm whether affected product deployments exist and assign an owner for follow-up. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest remediated assets, and close the item only after evidence is documented. Vulnerability management and security teams should prioritize this issue due to the potential for data tampering and unauthorized access, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Monitoring, detection, and logs for exposed assets should be reviewed for extra review, and asset inventory should be checked for exposed assets that need extra review. Rollback and change windows should be considered for remediation efforts, and source tracking should be implemented to monitor for potential exploitation attempts. This vulnerability has a CVSS score of 6.5 and a severity of MEDIUM, indicating a moderate level of risk. Therefore, it is essential for organizations to take proactive steps to mitigate this vulnerability and prevent potential data tampering or unauthorized access. The NVD entry is currently Analyzed, and the CVE record was published on 2026-08-19T22:17:21.653Z and has not been modified since then. The official CVE record and NVD detail page provide additional information on this vulnerability. The vendor advisory for Splunk SOAR vulnerability also provides guidance on mitigating this issue. By taking these steps, organizations can help prevent potential data tampering or unauthorized access and ensure the security of their Splunk SOAR deployments. Additionally, defenders should verify the affected scope, severity, and vendor's patch

Technical summary

A vulnerability in Splunk SOAR versions below 8.6.0 allows users with the 'Automation Engineer' role to run arbitrary SQL statements against the Splunk SOAR database, potentially leading to data tampering or unauthorized access. This issue arises from the incorporation of user-supplied input into database queries without proper neutralization, allowing an 'Automation Engineer' role user to run arbitrary SQL statements. The vulnerability is possible because Splunk SOAR playbook automation data APIs incorporate user-supplied input into database queries without proper neutralization.

Defensive priority

Organizations using Splunk SOAR versions below 8.6.0 should prioritize upgrading to a fixed version to prevent potential data tampering.

Recommended defensive actions

• Upgrade Splunk SOAR to version 8.6.0 or later
• Restrict 'Automation Engineer' role privileges
• Monitor database queries for suspicious activity
• Implement additional security controls to prevent data tampering
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability exists in Splunk SOAR playbook automation data APIs, which incorporate user-supplied input into database queries without proper neutralization, allowing an 'Automation Engineer' role user to run arbitrary SQL statements.

Official resources