CVE-2026-76361

Received Received - Intake

SSRF in Splunk SOAR Below 8.6.0

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../check_connectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The Server-Side Request Forgery (SSRF) is possible because the connectivity check REST API does not sufficiently validate the destination before Splunk SOAR connects to it. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76361

EUVD

EUVD-2026-62926

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_soar	to 8.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) in Splunk SOAR versions below 8.6.0. It allows an administrator to make the system initiate outbound network connections to arbitrary destinations and check if internal hosts and ports are reachable. The issue occurs because the connectivity check REST API does not properly validate the destination before connecting.

Impact Analysis

An attacker with administrator access could exploit this to probe internal networks, identify reachable hosts and open ports, or potentially access sensitive internal systems. This could lead to further attacks or data breaches if combined with other vulnerabilities.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized network probing or access to internal systems, potentially violating data protection requirements. GDPR and HIPAA require safeguards to prevent unauthorized access to personal or health data, which this SSRF could facilitate.

Mitigation Strategies

Upgrade Splunk SOAR to version 8.6.0 or later to address the SSRF vulnerability in the connectivity check REST API.

Hi! I’m here to help you understand CVE-2026-76361. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70