Arbitrary Code Execution in Splunk SOAR Affected by Role Management Issue

CVE-2026-76357

What is CVE-2026-76357?

In Splunk SOAR versions prior to 8.6.0, a security vulnerability exists that allows an authenticated user without an assigned role to execute arbitrary code through the REST API. The API's lack of role enforcement permits an attacker to submit a crafted file path that circumvents access controls, potentially leading to unauthorized execution of commands on the server. This vulnerability arises from the incorrect handling of user-supplied input, which is not restricted to the designated temporary directory. Organizations using affected versions should prioritize the update to mitigate this risk.

References