CVE-2026-76381

Received Received - Intake

Information Disclosure in MS Graph for Splunk SOAR App

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In versions below 1.5.2 of the MS Graph for Active Directory app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temp_password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76381

EUVD

EUVD-2026-62946

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	ms_graph_for_active_directory	to 1.5.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability exists in versions below 1.5.2 of the MS Graph for Active Directory app for Splunk SOAR. A user with permission to run actions can expose a sensitive password by using the reset password action. The password is shown in cleartext in the UI because the app does not mask the temp_password parameter.

Detection Guidance

Check Splunk SOAR app version for MS Graph for Active Directory. If version is below 1.5.2, the vulnerability is present. No specific commands are provided in the context.

Impact Analysis

An attacker with access to the UI could view sensitive passwords in cleartext, leading to unauthorized access to systems or data protected by those passwords. This could result in data breaches or further compromise of the environment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage due to exposed passwords.

Mitigation Strategies

Upgrade the MS Graph for Active Directory app for Splunk SOAR to version 1.5.2 or higher to address the password exposure issue.

Hi! I’m here to help you understand CVE-2026-76381. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70