{"id":"CVE-2026-76530","kind":"vulnerability","aliases":["CVE-2026-76530"],"related":[],"title":"Cisco: non-canonical URL paths let requests bypass authorization checks","description":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76530 are related to use of non-canonical URL paths for authorization decisions and are grouped under the Common Weakness Enumeration (CWE) CWE-647.","summary":"Splunk SOAR before 8.7.0 uses non-canonical URL paths in authorization decisions (CWE-647), so a crafted URL can bypass authorization checks. CVSS 8.8 (network, low privileges required). Part of Splunk's October 2026 SOAR hardening release, which fixes eight CVEs grouped by CWE; the worst in that advisory is CVE-2026-76531 at 9.9. Splunk's advisory does not say which endpoints are affected.","severity":"high","cvss":8.8,"epss":0.00222,"exploited":false,"exploited_at":null,"products":[{"name":"Splunk SOAR","fixed":["8.7.0"],"affected":"< 8.7.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["authorization-bypass","cisco","infrastructure","other","self-hosted","splunk","splunk-soar"],"not_affected_if":[],"how_to_check":"Check your Splunk SOAR version (Administration > About, or the product version page). Anything below 8.7.0 is affected. Splunk SOAR Cloud: confirm the version with Splunk.","fix":"Upgrade Splunk SOAR to 8.7.0 or higher, per SVD-2026-1011. No workaround is listed in the advisory.","status":"resolved","published_at":"2026-10-21T23:17:30+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:32:41+00:00","updated_at":"2026-10-24T07:15:52+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:32:41Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Cisco software hardening release referenced by the advisory; the sources do not name the version.","reach":"unknown","title":"Cisco: non-canonical URL paths let requests bypass authorization checks","impact":"medium","summary":"Cisco products mishandle non-canonical URL paths when making authorization decisions, which can let a request reach protected functions it should not. The sources do not name the affected products or versions, and the impact on what an attacker gets is not stated beyond the authorization bypass class.","category":"infrastructure","who_cares":["cisco"],"confidence":0.35,"needs_auth":"unknown","worst_case":"unknown authorization bypass reaches protected Cisco functions","analyst_note":"Find the Cisco security advisory for CVE-2026-76530 to name affected products, versions and the fixed release; NVD entry lacks product data.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000478,"input_tokens":2965,"output_tokens":362,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Cisco security advisory for CVE-2026-76530 to name affected products, versions and the fixed release; NVD entry lacks product data.","search":"'-2026':13A,16A,85B,139C '-647':47B,164C '-76530':14A,17A,140C '-76531':86B '2026':67B '8.7.0':36B '8.8':57B '9.9':88B 'address':129C 'advisori':82B,91B 'affect':98B 'author':10A,21B,44B,54B,152C 'authorization-bypass':20B 'bypass':9A,22B,53B 'canon':4A,40B,148C 'check':11A,55B 'cisco':1A,23B,102C,112C 'commit':105C 'common':159C 'comprehens':116C 'conduct':114C 'craft':50B 'cve':12A,15A,84B,138C 'cves':74B 'cvss':56B 'cwe':46B,77B,162C,163C 'decis':45B,153C 'discov':132C 'eight':73B 'endpoint':96B 'enumer':161C 'fix':72B 'group':75B,156C 'harden':69B,126C 'host':28B 'infrastructur':24B 'intern':117C,131C 'let':7A 'low':59B 'multipl':130C 'network':58B 'non':3A,39B,147C 'non-canon':2A,38B,146C 'octob':66B 'ongo':104C 'part':62B,100C 'path':6A,42B,150C 'privileg':60B 'proactiv':107C 'product':110C 'qualiti':111C 'relat':142C 'releas':70B,127C 'request':8A 'requir':61B 'result':122C 'review':119C,121C 'say':94B 'secur':108C,118C 'self':27B 'self-host':26B 'soar':19A,32B,34B,68B 'softwar':125C 'splunk':18A,29B,31B,33B,64B,89B 'splunk-soar':30B 'track':136C 'url':5A,41B,51B,149C 'use':37B,144C 'vulner':133C,135C 'weak':160C 'worst':79B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T23:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76530","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76530","severity":null,"published_at":"2026-10-21T23:17:30+00:00","modified_at":"2026-10-22T16:57:10+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76530:514","url":null,"severity":null,"published_at":"2026-10-23T23:46:18+00:00","modified_at":"2026-10-23T23:46:18+00:00","first_seen_at":"2026-10-23T23:46:18+00:00","fetched_at":"2026-10-23T23:46:18+00:00","note":"Not a Cisco-product bug: Splunk (Cisco-owned) SOAR. Splunk advisory SVD-2026-1011 (2026-10-21) lists Splunk SOAR below 8.7.0, fixed 8.7.0; one of 8 grouped CWE CVEs. No exploitation or PoC found; did not search social posts."},{"source":"epss","external_id":"CVE-2026-76530","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76530","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1432,"url":"https://advisory.splunk.com/advisories/SVD-2026-1011","title":"SVD-2026-1011 Security Hardening in Splunk SOAR - October 2026","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}