# Splunk SOAR vulnerabilities Source: https://junglewise.ai/threats/technologies/soar Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/soar.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 31 vulnerabilities in Splunk SOAR: 0 in the last 7 days and 30 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-76531, was published on 21 October 2026. 15 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 15 - Last 90 days: 30 - All time: 31 (0 critical, 0 exploited in the wild) ## About Splunk SOAR Splunk SOAR is a platform for orchestrating and automating security incident response processes. ## Latest Splunk SOAR vulnerabilities - [CVE-2026-76531: Splunk SOAR files or directories accessible to external parties](https://junglewise.ai/threats/cve-2026-76531-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76530: Splunk SOAR authorization bypass via non-canonical URL paths](https://junglewise.ai/threats/cve-2026-76530-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76529: Splunk SOAR improper protection of alternate path](https://junglewise.ai/threats/cve-2026-76529-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76528: Splunk SOAR protection mechanism failure](https://junglewise.ai/threats/cve-2026-76528-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76527: Splunk SOAR improper handling of exceptional conditions](https://junglewise.ai/threats/cve-2026-76527-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76526: Splunk SOAR improper neutralization in security hardening](https://junglewise.ai/threats/cve-2026-76526-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76408: Splunk SOAR improper resource control](https://junglewise.ai/threats/cve-2026-76408-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76407: Splunk SOAR improper access control](https://junglewise.ai/threats/cve-2026-76407-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and) (info, published 21 Oct 2026) - [CVE-2026-76406: Splunk SOAR credential decryption via REST API authentication](https://junglewise.ai/threats/cve-2026-76406-in-splunk-soar-versions-below-8-7-0-an-unauthenticated-user-with) (medium, CVSS 5.9, published 21 Oct 2026) - [CVE-2026-76308: Splunk SOAR missing authorization through REST API](https://junglewise.ai/threats/cve-2026-76308-in-splunk-soar-versions-below-8-7-0-an-authenticated-user-could) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-76307: Splunk SOAR authentication token disclosure in REST API](https://junglewise.ai/threats/cve-2026-76307-in-splunk-soar-versions-below-8-7-0-a-user-that-holds-a-role-with) (high, CVSS 7.2, published 21 Oct 2026) - [CVE-2026-76306: Splunk SOAR information disclosure through REST API query filters](https://junglewise.ai/threats/cve-2026-76306-in-splunk-soar-versions-below-8-7-0-a-user-that-has-the-observer) (high, CVSS 7.5, published 21 Oct 2026) - [CVE-2026-76305: Splunk SOAR improper access control during app downloads](https://junglewise.ai/threats/cve-2026-76305-in-splunk-soar-versions-below-8-7-0-an-authenticated-user-who) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-76304: Splunk SOAR access control bypass in Automation Broker configuration](https://junglewise.ai/threats/cve-2026-76304-in-splunk-soar-versions-below-8-7-0-an-authenticated-user-who) (medium, CVSS 4.3, published 21 Oct 2026) - [CVE-2026-76303: Splunk SOAR stored cross-site scripting in app documentation](https://junglewise.ai/threats/cve-2026-76303-in-splunk-soar-versions-below-8-7-0-a-user-that-holds-a-role-with) (medium, CVSS 5.7, published 21 Oct 2026) - [CVE-2026-76370: Splunk SOAR information disclosure through REST API authorization bypass](https://junglewise.ai/threats/cve-2026-76370-splunk-soar-information-disclosure-through-rest-api-authorization) (medium, CVSS 4.3, published 19 Aug 2026) - [CVE-2026-76369: Splunk SOAR path traversal in Automation Broker log uploads](https://junglewise.ai/threats/cve-2026-76369-splunk-soar-path-traversal-in-automation-broker-log-uploads) (low, CVSS 2.7, published 19 Aug 2026) - [CVE-2026-76368: Splunk SOAR missing authorization in playbooks](https://junglewise.ai/threats/cve-2026-76368-splunk-soar-missing-authorization-in-playbooks) (low, CVSS 2.7, published 19 Aug 2026) - [CVE-2026-76367: Splunk SOAR stored cross-site scripting in notes](https://junglewise.ai/threats/cve-2026-76367-splunk-soar-stored-cross-site-scripting-in-notes) (medium, CVSS 4, published 19 Aug 2026) - [CVE-2026-76366: Splunk SOAR REST API session token disclosure](https://junglewise.ai/threats/cve-2026-76366-splunk-soar-rest-api-session-token-disclosure) (medium, CVSS 6.5, published 19 Aug 2026) - [CVE-2026-76365: Splunk SOAR SQL injection through custom lists](https://junglewise.ai/threats/cve-2026-76365-splunk-soar-sql-injection-through-custom-lists) (medium, CVSS 6.5, published 19 Aug 2026) - [CVE-2026-76364: Splunk SOAR SQL injection through custom function results](https://junglewise.ai/threats/cve-2026-76364-splunk-soar-sql-injection-through-custom-function-results) (medium, CVSS 6.5, published 19 Aug 2026) - [CVE-2026-76363: Splunk SOAR SQL injection in REST API](https://junglewise.ai/threats/cve-2026-76363-splunk-soar-sql-injection-in-rest-api) (medium, CVSS 6.5, published 19 Aug 2026) - [CVE-2026-76362: Splunk SOAR improper certificate validation in CyberArk integration](https://junglewise.ai/threats/cve-2026-76362-splunk-soar-improper-certificate-validation-in-cyberark) (high, CVSS 7.4, published 19 Aug 2026) - [CVE-2026-76361: Splunk SOAR Server-Side Request Forgery in connectivity check REST API](https://junglewise.ai/threats/cve-2026-76361-splunk-soar-server-side-request-forgery-in-connectivity-check) (low, CVSS 2.7, published 19 Aug 2026) ## Most severe Splunk SOAR vulnerabilities - [CVE-2026-76356: Splunk SOAR IP address spoofing in Automation Broker](https://junglewise.ai/threats/cve-2026-76356-splunk-soar-ip-address-spoofing-in-automation-broker) (high, CVSS 8.1, published 19 Aug 2026) - [CVE-2026-76357: Splunk SOAR path traversal remote code execution in REST API](https://junglewise.ai/threats/cve-2026-76357-splunk-soar-path-traversal-remote-code-execution-in-rest-api) (high, CVSS 7.6, published 19 Aug 2026) - [CVE-2026-76306: Splunk SOAR information disclosure through REST API query filters](https://junglewise.ai/threats/cve-2026-76306-in-splunk-soar-versions-below-8-7-0-a-user-that-has-the-observer) (high, CVSS 7.5, published 21 Oct 2026) - [CVE-2026-76362: Splunk SOAR improper certificate validation in CyberArk integration](https://junglewise.ai/threats/cve-2026-76362-splunk-soar-improper-certificate-validation-in-cyberark) (high, CVSS 7.4, published 19 Aug 2026) - [CVE-2026-76307: Splunk SOAR authentication token disclosure in REST API](https://junglewise.ai/threats/cve-2026-76307-in-splunk-soar-versions-below-8-7-0-a-user-that-holds-a-role-with) (high, CVSS 7.2, published 21 Oct 2026) - [CVE-2026-76359: Splunk SOAR path traversal in Universal Forwarder installer](https://junglewise.ai/threats/cve-2026-76359-splunk-soar-path-traversal-in-universal-forwarder-installer) (medium, CVSS 6.5, published 19 Aug 2026) - [CVE-2026-76358: Splunk SOAR path traversal in app installation](https://junglewise.ai/threats/cve-2026-76358-splunk-soar-path-traversal-in-app-installation) (medium, CVSS 6.5, published 19 Aug 2026) - [CVE-2026-76363: Splunk SOAR SQL injection in REST API](https://junglewise.ai/threats/cve-2026-76363-splunk-soar-sql-injection-in-rest-api) (medium, CVSS 6.5, published 19 Aug 2026) - [CVE-2026-76365: Splunk SOAR SQL injection through custom lists](https://junglewise.ai/threats/cve-2026-76365-splunk-soar-sql-injection-through-custom-lists) (medium, CVSS 6.5, published 19 Aug 2026) - [CVE-2026-76364: Splunk SOAR SQL injection through custom function results](https://junglewise.ai/threats/cve-2026-76364-splunk-soar-sql-injection-through-custom-function-results) (medium, CVSS 6.5, published 19 Aug 2026) ## Vulnerabilities per week 15 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 15 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 15 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Splunk technologies - [Splunk Enterprise](https://junglewise.ai/threats/technologies/splunk-enterprise): 32 vulnerabilities - [Splunk](https://junglewise.ai/threats/technologies/splunk): 20 vulnerabilities - [Splunk Cloud Platform](https://junglewise.ai/threats/technologies/cloud-platform): 19 vulnerabilities - [Splunk AI Toolkit](https://junglewise.ai/threats/technologies/ai-toolkit): 12 vulnerabilities - [Splunk Secure Gateway](https://junglewise.ai/threats/technologies/secure-gateway): 10 vulnerabilities - [Splunk Connect For Kafka](https://junglewise.ai/threats/technologies/connect-for-kafka): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Splunk SOAR vulnerabilities", https://junglewise.ai/threats/technologies/soar, 9 November 2026.