CVE-2026-76377

Received Received - Intake

Information Disclosure in Azure AD Graph Splunk SOAR App

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In versions below 2.5.3 of the Azure AD Graph app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temp_password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76377

EUVD

EUVD-2026-62942

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	azure_ad_graph_app	to 2.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability exists in versions below 2.5.3 of the Azure AD Graph app for Splunk SOAR. A user with permission to run actions can expose a sensitive password by using the reset password action. The password appears in cleartext in the UI because the app does not mask the temp_password parameter.

Detection Guidance

Check the version of the Azure AD Graph app for Splunk SOAR. If it is below 2.5.3, the vulnerability is present. Review logs for actions involving the reset password feature to see if passwords are exposed in cleartext.

Impact Analysis

An attacker with access to the UI could view exposed passwords, leading to unauthorized account access or data breaches. This could compromise user accounts and sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality.

Mitigation Strategies

Upgrade the Azure AD Graph app for Splunk SOAR to version 2.5.3 or higher to address the information disclosure issue. Restrict permissions for users who can run actions to minimize exposure.

Hi! I’m here to help you understand CVE-2026-76377. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70