CVE-2026-76369

Received Received - Intake

Path Traversal in Splunk SOAR Automation Broker

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the intended Automation Broker log directory. The vulnerability is possible because Automation Broker log uploads accept crafted filename input before writing log files. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) and About Splunk SOAR Automation Broker (https://help.splunk.com/en/splunk-soar/splunk-automation-broker/about-splunk-soar-automation-broker/about-splunk-soar-automation-broker) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76369

EUVD

EUVD-2026-62934

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	soar	to 8.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability in Splunk SOAR versions below 8.6.0 allows a user with the OnPrem Broker role to write files outside the intended Automation Broker log directory. It occurs because the system accepts crafted filenames during log uploads before writing the files.

Impact Analysis

An attacker with the OnPrem Broker role could place malicious files in unintended directories, potentially leading to unauthorized access, data leakage, or system compromise. This could disrupt operations or allow further exploitation.

Compliance Impact

This vulnerability may violate compliance requirements by allowing unauthorized file writes, which could lead to data breaches or unauthorized access to sensitive information. Organizations using affected versions may fail to meet GDPR or HIPAA standards.

Mitigation Strategies

Upgrade Splunk SOAR to version 8.6.0 or higher to address the vulnerability. Restrict the OnPrem Broker role permissions to prevent unauthorized file writes outside the intended log directory.

Hi! I’m here to help you understand CVE-2026-76369. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70