Is CVE-2026-76357 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76357 being exploited in the wild.

How severe is CVE-2026-76357?

High severity, with a CVSS score of 7.6, published 19 August 2026.

Is there a fix for CVE-2026-76357?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-76357 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-76357?

Check whether you run Splunk SOAR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76357: Splunk SOAR path traversal remote code execution in REST API

CVE-2026-76357 · Severity: high · CVSS 7.6 · Published 2026-08-19

Splunk SOAR is an orchestration platform for security operations and incident response. An authenticated user without an assigned role can exploit a path traversal flaw in the REST API to execute arbitrary code on the SOAR server. This allows attackers with even basic authentication to gain full control of the security operations platform and the sensitive data it handles.

Technologies: Splunk SOAR. Vendors: Splunk.

Quick answers

Is CVE-2026-76357 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76357 being exploited in the wild.
How severe is CVE-2026-76357?: High severity, with a CVSS score of 7.6, published 19 August 2026.
Which products and versions are affected?: Splunk SOAR below 8.6.0.
Is there a fix for CVE-2026-76357?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76357 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-76357?: Check whether you run Splunk SOAR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a path traversal (CWE-22) in Splunk SOAR's REST API that allows authenticated users with no role assigned to bypass file path restrictions and achieve remote code execution. The REST API fails to validate that user-supplied file paths remain within the intended temporary directory, and does not enforce role-based access control for the vulnerable endpoint. Attack requires valid authentication credentials but no specific role assignment. Successful exploitation grants arbitrary code execution with SOAR service privileges, compromising confidentiality, integrity, and availability. The fix is available in version 8.6.0 and later.

Affected products

Splunk SOAR below 8.6.0

Timeline

2026-08-19: disclosed

References

https://advisory.splunk.com/advisories/SVD-2026-0804

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.