{"id":"CVE-2026-76308","kind":"vulnerability","aliases":["CVE-2026-76308"],"related":[],"title":"Splunk SOAR: any logged-in user can change the Enterprise Security license edition","description":"In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State Transfer (REST) API and cause Splunk SOAR to apply the license change.\nThe vulnerability is possible because Splunk SOAR authenticates requests to manage the Enterprise Security edition but does not authorize the caller before it applies the license change.\nFor more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.7.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Obtain and configure a Splunk SOAR (On-premises) license (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.7.0/configure-your-companys-settings-in-splunk-soar-on-premises/obtain-and-configure-a-splunk-soar-on-premises-license), and Integration of Splunk SOAR with Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.7/automation-with-playbooks/integration-of-splunk-soar-with-splunk-enterprise-security) in the Splunk documentation.","summary":"Splunk SOAR before 8.7.0 authenticates REST API requests to manage the Enterprise Security edition but does not check that the caller is authorized. An authenticated user can therefore switch the Enterprise Security edition and have SOAR apply the license change.","severity":"medium","cvss":6.5,"epss":0.00174,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["on-premises","other","splunk-enterprise-security","splunk-soar"],"not_affected_if":["soar-8.7.0-or-later"],"how_to_check":"- Check the installed SOAR version on the appliance or in the admin UI; versions below `8.7.0` are affected according to the sources\n- Review which accounts hold valid SOAR credentials, since an authenticated user is required\n- unknown whether a specific configuration changes exposure","fix":"- Upgrade Splunk SOAR (On-premises) to `8.7.0` or later, as stated in the sources\n- unknown whether a workaround or setting change exists before upgrading","status":"open","published_at":"2026-10-21T23:17:29+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:48:46+00:00","updated_at":"2026-10-25T03:48:46+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:48:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Splunk SOAR (On-premises) to `8.7.0` or later, as stated in the sources\n- unknown whether a workaround or setting change exists before upgrading","reach":"network","title":"Splunk SOAR: any logged-in user can change the Enterprise Security license edition","impact":"low","summary":"Splunk SOAR before 8.7.0 authenticates REST API requests to manage the Enterprise Security edition but does not check that the caller is authorized. An authenticated user can therefore switch the Enterprise Security edition and have SOAR apply the license change.","category":"other","nicknames":[],"who_cares":["splunk-soar","on-premises","splunk-enterprise-security"],"confidence":0.6,"needs_auth":"yes","worst_case":"A logged-in user changes the Enterprise Security license edition","analyst_note":"Confirm the affected version range and whether a workaround exists before 8.7.0, using the Splunk SOAR release notes and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-76308.","how_to_check":"- Check the installed SOAR version on the appliance or in the admin UI; versions below `8.7.0` are affected according to the sources\n- Review which accounts hold valid SOAR credentials, since an authenticated user is required\n- unknown whether a specific configuration changes exposure","needs_analyst":true,"not_affected_if":["soar-8.7.0-or-later"],"who_is_affected":"Teams running on-premises Splunk SOAR below `8.7.0` that integrate it with Splunk Enterprise Security and have user accounts with REST API access. The sources do not describe a non-default configuration, so the exposure appears to depend on having an authenticated account. Teams on `8.7.0` or later, or on a version not listed as affected, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000707,"input_tokens":3718,"output_tokens":671,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-76308':17A,20A '/en/splunk-enterprise-security-8/administer/8.7/automation-with-playbooks/integration-of-splunk-soar-with-splunk-enterprise-security)':172C '/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.7.0/configure-your-companys-settings-in-splunk-soar-on-premises/obtain-and-configure-a-splunk-soar-on-premises-license),':160C '/en/splunk-soar/soar-on-premises/rest-api-reference/8.7.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises),':147C '8.7.0':35B,77C 'api':38B,93C,137C 'appli':68B,99C,126C 'authent':36B,56B,79C,110C 'author':54B,121C 'caller':52B,123C 'caus':95C 'chang':9A,71B,82C,102C,129C 'check':49B 'configur':150C 'could':81C 'cve':15A,18A 'document':176C 'edit':14A,45B,64B,86C,117C 'enterpris':11A,27B,43B,62B,84C,115C,168C 'help.splunk.com':146C,159C,171C 'help.splunk.com/en/splunk-enterprise-security-8/administer/8.7/automation-with-playbooks/integration-of-splunk-soar-with-splunk-enterprise-security)':170C 'help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.7.0/configure-your-companys-settings-in-splunk-soar-on-premises/obtain-and-configure-a-splunk-soar-on-premises-license),':158C 'help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.7.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises),':145C 'inform':132C 'integr':162C 'licens':13A,70B,101C,128C,157C 'log':5A 'logged-in':4A 'manag':41B,113C 'obtain':148C 'on-premis':21B,142C,154C 'possibl':106C 'premis':23B,144C,156C 'refer':138C 'represent':89C 'request':39B,111C 'rest':37B,92C,136C 'secur':12A,28B,44B,63B,85C,116C,169C 'see':133C 'soar':2A,31B,33B,67B,74C,97C,109C,141C,153C,165C 'splunk':1A,26B,30B,32B,73C,96C,108C,140C,152C,164C,167C,175C 'splunk-enterprise-secur':25B 'splunk-soar':29B 'state':90C 'switch':60B 'therefor':59B 'transfer':91C 'use':134C 'user':7A,57B,80C 'version':75C 'vulner':104C","nicknames":[],"mitigations":[],"who_affected":"Teams running on-premises Splunk SOAR below `8.7.0` that integrate it with Splunk Enterprise Security and have user accounts with REST API access. The sources do not describe a non-default configuration, so the exposure appears to depend on having an authenticated account. Teams on `8.7.0` or later, or on a version not listed as affected, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T23:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76308","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76308","severity":null,"published_at":"2026-10-21T23:17:29+00:00","modified_at":"2026-10-22T16:57:10+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76308","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76308","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}