CVE-2026-76406

In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an affected Splunk SOAR instance could submit Basic authentication data to the Representational State Transfer (REST) API to expose and decrypt that encrypted credential data. The vulnerability is possible because Splunk SOAR decrypts encrypted Basic authentication values before completing authentication checks. The attack requires the unauthenticated user to have encrypted credential data from an affected Splunk SOAR instance. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises) in the Splunk documentation.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://advisory.splunk.com/advisories/SVD-2026-1010	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:splunk:soar:*:*:*:*:on-premises:*:*:*

History

29 Oct 2026, 19:58

Type	Values Removed	Values Added
First Time		Splunk soar Splunk
CPE		cpe:2.3:a:splunk:soar:::::on-premises:::*
References	~~() https://advisory.splunk.com/advisories/SVD-2026-1010 -~~	() https://advisory.splunk.com/advisories/SVD-2026-1010 - Patch, Vendor Advisory

21 Oct 2026, 23:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-21 23:17

Updated : 2026-10-29 19:58

NVD link : CVE-2026-76406

Mitre link : CVE-2026-76406

CVE.ORG link : CVE-2026-76406

JSON object : View

Products Affected

splunk

soar

CWE

CWE-203

Observable Discrepancy

{"id": "CVE-2026-76406", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76406", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-28T02:08:22.461073Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Splunk", "modules": ["REST API"], "product": "Splunk SOAR", "versions": [{"status": "affected", "version": "0", "lessThan": "8.7.0", "versionType": "custom"}]}]}], "published": "2026-10-21T23:17:29.180", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2026-1010", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-203"}]}], "descriptions": [{"lang": "en", "value": "In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an affected Splunk SOAR instance could submit Basic authentication data to the Representational State Transfer (REST) API to expose and decrypt that encrypted credential data.\nThe vulnerability is possible because Splunk SOAR decrypts encrypted Basic authentication values before completing authentication checks.\nThe attack requires the unauthenticated user to have encrypted credential data from an affected Splunk SOAR instance. The unauthenticated user should not be able to exploit the vulnerability at will.\nFor more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises) in the Splunk documentation."}], "lastModified": "2026-10-29T19:58:05.377", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:splunk:soar:*:*:*:*:on-premises:*:*:*", "vulnerable": true, "matchCriteriaId": "2B91E726-2A57-4B8B-A37D-1A6EB2C0E135", "versionEndExcluding": "8.7.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@cisco.com"}