CVE-2026-76367

Received Received - Intake

Stored XSS in Splunk SOAR Incident Notes

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the browser of another user when that user opens the note. The stored Cross-Site Scripting (XSS) vulnerability is possible because Splunk SOAR can treat existing note content as Hypertext Markup Language (HTML) without sanitizing that content when the note format changes. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "Incident Commander" Splunk SOAR role should not be able to exploit the vulnerability at will. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76367

EUVD

EUVD-2026-62932

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_soar	to 8.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored Cross-Site Scripting (XSS) flaw in Splunk SOAR versions below 8.6.0. A user with the 'Incident Commander' role can insert JavaScript into a note, which executes in another user's browser when they view the note. The issue occurs because Splunk SOAR treats note content as HTML without proper sanitization when the note format changes.

Detection Guidance

Detecting this vulnerability requires monitoring Splunk SOAR instances for unauthorized note modifications or suspicious JavaScript execution. Check Splunk SOAR logs for notes created or edited by users with the 'Incident Commander' role. Look for HTML content in notes that may contain script tags or event handlers.

Impact Analysis

An attacker could exploit this to run malicious JavaScript in your browser, potentially stealing session cookies, redirecting you to phishing sites, or performing unauthorized actions on your behalf. The attack requires tricking you into opening a specially crafted note.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized JavaScript execution in a user's browser. This may lead to data exposure or manipulation if an attacker exploits the XSS flaw to access or alter sensitive information. Organizations using Splunk SOAR versions below 8.6.0 may face increased compliance risks due to potential breaches of confidentiality and integrity.

Mitigation Strategies

Upgrade Splunk SOAR to version 8.6.0 or later to address the vulnerability. Restrict the 'Incident Commander' role permissions to prevent note editing. Implement input validation for notes to strip HTML tags or sanitize content. Monitor user activity for phishing attempts targeting note interactions.

Hi! I’m here to help you understand CVE-2026-76367. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70