CVE-2026-76378

Received Received - Intake

Information Disclosure in Cisco Secure Malware Analytics for Splunk SOAR

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In versions below 2.4.5 of the Cisco Secure Malware Analytics app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive sample password by invoking the detonate file action, because the action's sample_password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76378

EUVD

EUVD-2026-62943

Affected Vendors & Products

Vendor	Product	Version / Range
cisco	secure_malware_analytics	to 2.4.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Cisco Secure Malware Analytics app for Splunk SOAR versions below 2.4.5. A user with permission to run actions can expose a sensitive sample password by using the detonate file action. The sample_password parameter is displayed in cleartext in the UI because it is not masked as a password field.

Detection Guidance

Check the version of the Cisco Secure Malware Analytics app for Splunk SOAR. If it is below 2.4.5, the vulnerability is present. Review user interface logs for instances where the sample_password parameter is exposed in cleartext during the detonate file action.

Impact Analysis

An attacker with access to the UI could view the sensitive sample password, potentially leading to unauthorized access or misuse of the detonate file action. This could compromise the security of the system and any data processed through it.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, which may violate compliance requirements such as GDPR or HIPAA. It risks data confidentiality and could result in regulatory penalties or legal consequences.

Mitigation Strategies

Upgrade the Cisco Secure Malware Analytics app for Splunk SOAR to version 2.4.5 or higher to address the information disclosure issue. Ensure that only trusted users have permission to run actions with sensitive parameters.

Hi! I’m here to help you understand CVE-2026-76378. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70