In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the browser of another user when that user opens the note. The stored Cross-Site Scripting (XSS) vulnerability is possible because Splunk SOAR can treat existing note content as Hypertext Markup Language (HTML) without sanitizing that content when the note format changes. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "Incident Commander" Splunk SOAR role should not be able to exploit the vulnerability at will. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) in the Splunk documentation.
References
| Link | Resource |
|---|---|
| https://advisory.splunk.com/advisories/SVD-2026-0804 | Vendor Advisory |
Configurations
History
No history.
Information
Published : 2026-08-19 22:17
Updated : 2026-08-26 16:16
NVD link : CVE-2026-76367
Mitre link : CVE-2026-76367
CVE.ORG link : CVE-2026-76367
JSON object : View
Products Affected
splunk
- soar
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')