CVE-2026-76356

Received Received - Intake

Unauthenticated IP Spoofing in Splunk SOAR Automation Broker

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to an Automation Broker notification endpoint and execute arbitrary code on the Splunk SOAR host. The vulnerability is possible because the Splunk SOAR Automation Broker trusts a client-supplied source IP address header as proof that the request originates from the local system. Successful exploitation can expose all relevant data, affect system integrity, and disrupt service availability. For more information see About Splunk SOAR Automation Broker (https://help.splunk.com/en/splunk-soar/splunk-automation-broker/about-splunk-soar-automation-broker/about-splunk-soar-automation-broker) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76356

EUVD

EUVD-2026-62921

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_soar	to 8.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability in Splunk SOAR versions below 8.6.0 allows an unauthenticated user to spoof the source IP address in a crafted request to an Automation Broker notification endpoint. This can lead to arbitrary code execution on the Splunk SOAR host because the Automation Broker incorrectly trusts client-supplied source IP address headers as proof of local origin.

Detection Guidance

Detecting this vulnerability requires checking Splunk SOAR versions below 8.6.0 and monitoring for unauthorized requests to Automation Broker notification endpoints. Inspect network logs for requests with spoofed source IP addresses or unusual traffic patterns targeting the Automation Broker. No specific commands are provided in the context.

Impact Analysis

Exploitation can expose all relevant data, affect system integrity by allowing unauthorized code execution, and disrupt service availability. The high CVSS score (8.1) indicates significant risk due to potential for complete system compromise.

Mitigation Strategies

Immediately upgrade Splunk SOAR to version 8.6.0 or later to address the vulnerability. Ensure the Automation Broker no longer trusts client-supplied source IP address headers. Review and restrict access to Automation Broker notification endpoints to prevent unauthorized requests.

Hi! I’m here to help you understand CVE-2026-76356. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70