Live › vulnerability › CVE-2026-76308
Go to dashboardSplunk SOAR before 8.7.0 authenticates REST API requests to manage the Enterprise Security edition but does not check that the caller is authorized. An authenticated user can therefore switch the Enterprise Security edition and have SOAR apply the license change.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running on-premises Splunk SOAR below that integrate it with Splunk Enterprise Security and have user accounts with REST API access. The sources do not describe a non-default configuration, so the exposure appears to depend on having an authenticated account. Teams on or later, or on a version not listed as affected, can skip it.
8.7.08.7.0No product ranges from the sources yet.
8.7.0 are affected according to the sources8.7.0 or later, as stated in the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State Transfer (REST) API and cause Splunk SOAR to apply the license change. The vulnerability is possible because Splunk SOAR authenticates requests to manage the Enterprise Security edition but does not authorize the caller before it applies the license change. For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.7.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Obtain and configure a Splunk SOAR (On-premises) license (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.7.0/configure-your-companys-settings-in-splunk-soar-on-premises/obtain-and-configure-a-splunk-soar-on-premises-license), and Integration of Splunk SOAR with Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.7/automation-with-playbooks/integration-of-splunk-soar-with-splunk-enterprise-security) in the Splunk documentation.
This page as .md · .json · in your agent: get_signal("CVE-2026-76308")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.