CVE-2026-76526: Splunk SOAR improper neutralization in security hardening

CVE-2026-76526 · Severity: info · Published 2026-10-21

Splunk SOAR, an enterprise security orchestration platform, contained an improper neutralization vulnerability as part of a group of internally discovered security issues. The vulnerability could allow an attacker to bypass input validation or security controls, potentially leading to unauthorized access or data manipulation. Splunk addressed this with a security hardening release.

Technologies: Splunk SOAR. Vendors: Splunk.

Quick answers

Is CVE-2026-76526 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-76526 being exploited in the wild.
How severe is CVE-2026-76526?
Informational severity, published 21 October 2026.
Which products and versions are affected?
Splunk SOAR 8.7 before 8.7.0.
Is there a fix for CVE-2026-76526?
Yes: fixed in SOAR 8.7.0 or higher. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76526 attacked?
It is in a hosted service.
Am I affected by CVE-2026-76526?
Check whether you run Splunk SOAR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: SOAR 8.7.0 or higher

Technical details

CVE-2026-76526 represents an improper neutralization vulnerability (CWE-707) identified during Splunk's internal security review. The vulnerability is grouped with other findings under a single CVE identifier; the highest CVSS score for this group is 8.8. Details on the specific attack vector, affected components, and exploitation requirements are not publicly disclosed in the advisory.

Affected products

  • Splunk SOAR 8.7 before 8.7.0

Timeline

  • 2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.