# CVE-2026-76531: Splunk SOAR files or directories accessible to external parties

Source: https://junglewise.ai/threats/cve-2026-76531-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-76531 · Severity: info · Published 2026-10-21

Splunk SOAR, a security orchestration and automation platform used by enterprises to manage security incidents, contains a vulnerability that allows files or directories to be accessed by external parties. This could enable unauthorized access to sensitive configuration data, credentials, or incident information stored within the system.

Technologies: [Splunk SOAR](https://junglewise.ai/threats/technologies/soar). Vendors: [Splunk](https://junglewise.ai/threats/vendors/splunk).

## Quick answers

**Is CVE-2026-76531 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76531 being exploited in the wild.

**How severe is CVE-2026-76531?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** Splunk SOAR Below 8.7.0.

**Is there a fix for CVE-2026-76531?** Yes: fixed in 8.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76531 attacked?** It is in a hosted service.

**Am I affected by CVE-2026-76531?** Check whether you run Splunk SOAR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 8.7.0

## Technical details

A file or directory accessibility vulnerability (CWE-552) in Splunk SOAR allows external parties to access sensitive resources. The vulnerability was internally identified by Splunk during a comprehensive security review. A fix is available in version 8.7.0.

## Affected products

- Splunk SOAR Below 8.7.0

## Timeline

- 2026-10-21: disclosed

## References

- [https://advisory.splunk.com/advisories/SVD-2026-1011](https://advisory.splunk.com/advisories/SVD-2026-1011)

## Related threats

- [Splunk SOAR authorization bypass via non-canonical URL paths](https://junglewise.ai/threats/cve-2026-76530-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk SOAR improper protection of alternate path](https://junglewise.ai/threats/cve-2026-76529-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk SOAR protection mechanism failure](https://junglewise.ai/threats/cve-2026-76528-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk SOAR improper handling of exceptional conditions](https://junglewise.ai/threats/cve-2026-76527-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk SOAR improper neutralization in security hardening](https://junglewise.ai/threats/cve-2026-76526-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)