Is CVE-2026-76370 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76370 being exploited in the wild.

How severe is CVE-2026-76370?

Medium severity, with a CVSS score of 4.3, published 19 August 2026.

Is there a fix for CVE-2026-76370?

A patch was published on 2026-08-19: Fixed in SOAR 8.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76370 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-76370?

Check whether you run Splunk SOAR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76370: Splunk SOAR information disclosure through REST API authorization bypass

CVE-2026-76370 · Severity: medium · CVSS 4.3 · Published 2026-08-19

Splunk SOAR is a security orchestration platform that helps organizations automate and manage security operations. In versions before 8.6.0, authenticated users with restricted roles can bypass access controls via the REST API to view confidential information about multi-tenant configurations they should not have access to, including names and identifiers of other tenants. This allows insiders to discover organizational structure and potentially target other business units.

Technologies: Splunk SOAR. Vendors: Splunk.

Quick answers

Is CVE-2026-76370 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76370 being exploited in the wild.
How severe is CVE-2026-76370?: Medium severity, with a CVSS score of 4.3, published 19 August 2026.
Which products and versions are affected?: Splunk SOAR below 8.6.0.
Is there a fix for CVE-2026-76370?: A patch was published on 2026-08-19: Fixed in SOAR 8.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76370 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-76370?: Check whether you run Splunk SOAR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass (CWE-863: Incorrect Authorization) in the REST API's multi-tenant tenant-listing endpoint. The root cause is that Splunk SOAR fails to enforce role-based tenant restrictions when returning tenant information through the REST API in multi-tenant deployments. An authenticated user with a restricted role can call REST API endpoints to enumerate all tenants in the system, bypassing the intended tenant access controls. No elevated privileges or user interaction are required beyond authentication; exploitation is trivial. The fix is to upgrade to Splunk SOAR 8.6.0 or later.

Affected products

Splunk SOAR below 8.6.0

Timeline

2026-08-19: disclosed
2026-08-19: patched: Fixed in SOAR 8.6.0

References

https://advisory.splunk.com/advisories/SVD-2026-0804

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.