# CVE-2026-76529: Splunk SOAR improper protection of alternate path

Source: https://junglewise.ai/threats/cve-2026-76529-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-76529 · Severity: info · Published 2026-10-21

Splunk SOAR, a security orchestration and automation platform, contains a vulnerability in how it protects alternate system paths. An attacker could exploit this to bypass intended access controls and reach protected functionality. Splunk has released version 8.7.0 with a security hardening update that fixes this and multiple other internally discovered vulnerabilities.

Technologies: [Splunk SOAR](https://junglewise.ai/threats/technologies/soar). Vendors: [Splunk](https://junglewise.ai/threats/vendors/splunk).

## Quick answers

**Is CVE-2026-76529 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76529 being exploited in the wild.

**How severe is CVE-2026-76529?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** Splunk SOAR below 8.7.0.

**Is there a fix for CVE-2026-76529?** Yes: fixed in 8.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76529 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-76529?** Check whether you run Splunk SOAR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 8.7.0

## Technical details

CVE-2026-76529 addresses improper protection of alternate paths (CWE-424) in Splunk SOAR, allowing attackers to potentially circumvent access control mechanisms through non-standard routing. The vulnerability was internally identified by Splunk as part of a comprehensive security review. Affected versions are below 8.7.0, with the fix provided in version 8.7.0 and later.

## Affected products

- Splunk SOAR below 8.7.0

## Timeline

- 2026-10-21: disclosed
- 2026-10-21: patched

## References

- [https://advisory.splunk.com/advisories/SVD-2026-1011](https://advisory.splunk.com/advisories/SVD-2026-1011)

## Related threats

- [Splunk SOAR files or directories accessible to external parties](https://junglewise.ai/threats/cve-2026-76531-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk SOAR authorization bypass via non-canonical URL paths](https://junglewise.ai/threats/cve-2026-76530-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk SOAR protection mechanism failure](https://junglewise.ai/threats/cve-2026-76528-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk SOAR improper handling of exceptional conditions](https://junglewise.ai/threats/cve-2026-76527-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk SOAR improper neutralization in security hardening](https://junglewise.ai/threats/cve-2026-76526-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)