CVE-2026-76384

Received Received - Intake

Information Disclosure in Splunk Attack Analyzer Connector

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In versions below 2.2.1 of the Splunk Attack Analyzer Connector for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by invoking either the detonate file or detonate url action, because the action's archive_password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76384

EUVD

EUVD-2026-62949

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_attack_analyzer_connector	to 2.2.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Splunk Attack Analyzer Connector versions below 2.2.1. A user with permission to run actions can expose a sensitive archive password by using the detonate file or detonate url action. The password is displayed in cleartext in the UI because the app does not mask the archive_password parameter.

Detection Guidance

Check the version of the Splunk Attack Analyzer Connector installed on your system. If it is below 2.2.1, the vulnerability is present. Run commands like 'splunk list app splunk_attack_analyzer_connector' or check the app's version in the Splunk SOAR interface.

Impact Analysis

An attacker with access to the UI could view the archive password, potentially leading to unauthorized access to sensitive archives. This could compromise data integrity or confidentiality if the archives contain confidential information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protecting health information. Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Upgrade the Splunk Attack Analyzer Connector to version 2.2.1 or later. Remove or restrict access for users with roles that can run actions until the upgrade is completed. Review user permissions to ensure least privilege access.

Hi! I’m here to help you understand CVE-2026-76384. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70