CVE-2026-76372

Received Received - Intake

Nmap Scanner Command Execution via Safe Mode Playbook

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system through Nmap Scripting Engine scripts. The vulnerability is possible because the Nmap Scanner connector action manifest classifies the scan network action as read-only even though the action accepts script parameters that can perform write operations. For more information see Manage settings for a playbook in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/manage-settings-for-a-playbook-in-splunk-soar-cloud) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76372

EUVD

EUVD-2026-62937

Affected Vendors & Products

Vendor	Product	Version / Range
nmap	nmap	to 3.0.15 (exc)
splunk	splunk_soar	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Nmap Scanner versions below 3.0.15 within Splunk SOAR. A user with edit, create, or run playbook permissions can execute the scan network action in a Safe Mode playbook, even though it is marked as read-only. This is because the action accepts script parameters that enable write operations, potentially allowing command execution or system changes on target systems via the Nmap Scripting Engine.

Impact Analysis

If exploited, this vulnerability could allow an attacker with appropriate permissions to execute unauthorized commands or make changes on target systems. This could lead to data breaches, system compromise, or unauthorized access to sensitive information, depending on the permissions of the compromised account.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected versions may face legal penalties, reputational damage, or loss of certification if sensitive data is compromised due to this flaw.

Mitigation Strategies

Update Nmap Scanner to version 3.0.15 or later to address the misclassification of the scan network action. Review and restrict roles that can edit, create, or run playbooks in Splunk SOAR to prevent unauthorized use of the vulnerable action.

Hi! I’m here to help you understand CVE-2026-76372. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70