CVE-2026-76356

Analyzed Analyzed - Analysis Complete

Unauthenticated IP Spoofing in Splunk SOAR Automation Broker

Publication date: 2026-08-19

Last updated on: 2026-08-27

Assigner: Cisco Systems, Inc.

Description

In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to an Automation Broker notification endpoint and execute arbitrary code on the Splunk SOAR host. The vulnerability is possible because the Splunk SOAR Automation Broker trusts a client-supplied source IP address header as proof that the request originates from the local system. Successful exploitation can expose all relevant data, affect system integrity, and disrupt service availability. For more information see About Splunk SOAR Automation Broker (https://help.splunk.com/en/splunk-soar/splunk-automation-broker/about-splunk-soar-automation-broker/about-splunk-soar-automation-broker) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-27

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-76356

EUVD

EUVD-2026-62921

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	soar	to 8.6.0 (exc)
splunk	soar	to 8.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability in Splunk SOAR versions below 8.6.0 allows an unauthenticated user to spoof the source IP address in a crafted request to an Automation Broker notification endpoint. This can lead to arbitrary code execution on the Splunk SOAR host because the Automation Broker incorrectly trusts client-supplied source IP address headers as proof of local origin.

Detection Guidance

Detecting this vulnerability requires checking Splunk SOAR versions below 8.6.0 and monitoring for unauthorized requests to Automation Broker notification endpoints. Inspect network logs for requests with spoofed source IP addresses or unusual traffic patterns targeting the Automation Broker. No specific commands are provided in the context.

Impact Analysis

Exploitation can expose all relevant data, affect system integrity by allowing unauthorized code execution, and disrupt service availability. The high CVSS score (8.1) indicates significant risk due to potential for complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Unauthorized code execution may also compromise system integrity, affecting compliance with integrity and availability requirements in these regulations.

Mitigation Strategies

Immediately upgrade Splunk SOAR to version 8.6.0 or later to address the vulnerability. Ensure the Automation Broker no longer trusts client-supplied source IP address headers. Review and restrict access to Automation Broker notification endpoints to prevent unauthorized requests.

Hi! I’m here to help you understand CVE-2026-76356. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70