CVE-2026-76386

Received Received - Intake

Information Disclosure in Zoom App for Splunk SOAR

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In versions below 3.2.2 of the Zoom app for Splunk SOAR, a user who holds a role with permission to run actions could expose meeting and personal meeting ID passwords by invoking one of the create meeting, update meeting, or update user settings actions, because the affected password and pmi_password parameters are not masked and are shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameters as passwords. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76386

EUVD

EUVD-2026-62951

Affected Vendors & Products

Vendor	Product	Version / Range
zoom	zoom	to 3.2.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Zoom app for Splunk SOAR versions below 3.2.2. A user with permission to run actions could expose meeting and personal meeting ID passwords in cleartext through the UI. This happens because the app does not mask the password and pmi_password parameters during actions like creating or updating meetings.

Detection Guidance

Check if your Zoom app for Splunk SOAR version is below 3.2.2. Review action logs for create meeting, update meeting, or update user settings where password parameters appear in cleartext.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to view sensitive meeting and personal meeting ID passwords. This may lead to unauthorized access to meetings, potential data breaches, or misuse of meeting credentials.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA due to unauthorized exposure of sensitive meeting data. Organizations may face legal penalties, reputational damage, and loss of trust if such data leaks occur.

Mitigation Strategies

Upgrade the Zoom app for Splunk SOAR to version 3.2.2 or later. Restrict roles with permission to run actions to minimize exposure. Monitor logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-76386. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70