CVE-2026-76362: fallo de gravedad alta en Splunk SOAR
Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOAR
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.4epss 0.2%
In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer (REST) server could access or modify all relevant data exchanged through that credential manager. The vulnerability is possible because the CyberArk REST client does not verify server certificates by default. The attack requires the attacker to have network-path interception capability between Splunk SOAR and the configured CyberArk REST server. For more information see Manage your organization's credentials with a password vault (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/configure-administration-settings-in-splunk-soar-cloud/manage-your-organizations-credentials-with-a-password-vault) in the Splunk documentation.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
Splunk · Splunk SOARCVEs relacionadas — Splunk SOAR
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-76356HIGHAuthentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAREPSS 0.6%CVE-2026-76359MEDIUMPath Traversal through Universal Forwarder Installer Archive Extraction in Splunk SOAREPSS 0.5%CVE-2026-76358MEDIUMPath Traversal through App Installation Tar Extraction in Splunk SOAREPSS 0.5%CVE-2026-76357HIGHRemote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAREPSS 0.4%CVE-2026-76527CRITICALImproper Check or Handling of Exceptional Conditions in Splunk SOAREPSS 0.4%CVE-2026-76407CRITICALImproper Access Control in Splunk SOAREPSS 0.4%