How severe is CVE-2026-76363?

CVE-2026-76363 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2026-76363 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-76363?

CVE-2026-76363 affects Splunk Soar. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-76363?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-76363 published?

CVE-2026-76363 was published on 2026-08-19 and last updated on 2026-08-21.

CVE-2026-76363

CVE-2026-76363 is a medium-severity vulnerability in Splunk Soar with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-943.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (22nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-943
Affected product: Splunk Soar
Published: 2026-08-19
Last modified: 2026-08-21

Description

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database and create, read, update, or delete all data in the database. The vulnerability is possible because Splunk SOAR playbook automation data APIs incorporate user-supplied input into database queries without proper neutralization. For more information see Manage roles and permissions in Splunk SOAR Cloud (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) in the Splunk documentation.

Frequently asked questions

What is CVE-2026-76363?: In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database and create, read, update, or delete all data in the database. The vulnerability is possible because Splunk SOAR playbook automation data APIs incorporate user-supplied input into database queries without proper neutralization. For more information see Manage roles and permissions in Splunk SOAR Cloud (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) in the Splunk documentation.
How severe is CVE-2026-76363?: CVE-2026-76363 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2026-76363 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-76363?: CVE-2026-76363 affects Splunk Soar. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-76363?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-76363 published?: CVE-2026-76363 was published on 2026-08-19 and last updated on 2026-08-21.

References

https://advisory.splunk.com/advisories/SVD-2026-0804

Affected products (1)

cpe:2.3:a:splunk:soar:*:*:*:*:cloud:*:*:*

More vulnerabilities in Splunk Soar

CVE-2023-3997 — High (CVSS 8.6): Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the…
CVE-2026-76356 — High (CVSS 8.1): In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to…
CVE-2026-76357 — High (CVSS 7.6): In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to…
CVE-2026-76362 — High (CVSS 7.4): In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk…
CVE-2026-76366 — Medium (CVSS 6.5): In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer…
CVE-2026-76365 — Medium (CVSS 6.5): In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary…

All CVEs affecting Splunk Soar →

Other CWE-943 vulnerabilities

CVE-2026-40141 — Critical (CVSS 9.9): A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote…
CVE-2024-4872 — Critical (CVSS 9.9): A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. If exploited this could allow an…
CVE-2026-41274 — Critical (CVSS 9.8): Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the…
CVE-2026-40351 — Critical (CVSS 9.8): FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses…
CVE-2026-32248 — Critical (CVSS 9.8): Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to…
CVE-2026-29793 — Critical (CVSS 9.8): Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0…

Browse all CWE-943 vulnerabilities →