CVE-2026-76382

Received Received - Intake

Information Disclosure in Splunk SOAR Phantom App

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In versions below 3.8.5 of the Phantom app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by invoking the deflate item action, because the action's password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76382

EUVD

EUVD-2026-62947

Affected Vendors & Products

Vendor	Product	Version / Range
cisco	phantom	to 3.8.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

In Phantom app for Splunk SOAR versions below 3.8.5, a user with permission to run actions could expose a sensitive archive password by using the deflate item action. The password parameter is displayed in cleartext in the UI because it is not masked as a password field.

Detection Guidance

Check the Phantom app version for Splunk SOAR. If it is below 3.8.5, the vulnerability may be present. Look for actions using the deflate item action where the password parameter is visible in cleartext in the UI.

Impact Analysis

An attacker with access to the UI could view the archive password, potentially leading to unauthorized access to sensitive data or systems protected by that password.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR (data protection) or HIPAA (health information privacy) requirements for safeguarding personal or health data.

Mitigation Strategies

Upgrade the Phantom app for Splunk SOAR to version 3.8.5 or higher to address the password exposure issue. Ensure all users with action permissions follow secure practices and review logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-76382. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70