---
id: "CVE-2026-76530"
kind: "vulnerability"
aliases: ["CVE-2026-76530"]
title: "Cisco: non-canonical URL paths let requests bypass authorization checks"
severity: "high"
cvss: 8.8
epss: 0.00222
exploited: false
status: "resolved"
category: "infrastructure"
products: [{"name": "Splunk SOAR", "fixed": ["8.7.0"], "affected": "< 8.7.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["authorization-bypass", "cisco", "infrastructure", "other", "self-hosted", "splunk", "splunk-soar"]
not_affected_if: []
published_at: "2026-10-21T23:17:30+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T07:15:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76530", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:46:18+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76530", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Cisco: non-canonical URL paths let requests bypass authorization checks

Splunk SOAR before 8.7.0 uses non-canonical URL paths in authorization decisions (CWE-647), so a crafted URL can bypass authorization checks. CVSS 8.8 (network, low privileges required). Part of Splunk's October 2026 SOAR hardening release, which fixes eight CVEs grouped by CWE; the worst in that advisory is CVE-2026-76531 at 9.9. Splunk's advisory does not say which endpoints are affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Splunk SOAR affected < 8.7.0 fixed 8.7.0

## How to check

Check your Splunk SOAR version (Administration > About, or the product version page). Anything below 8.7.0 is affected. Splunk SOAR Cloud: confirm the version with Splunk.

## Fix

Upgrade Splunk SOAR to 8.7.0 or higher, per SVD-2026-1011. No workaround is listed in the advisory.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76530
- 2026-10-23T23:46:18+00:00 analyst — Not a Cisco-product bug: Splunk (Cisco-owned) SOAR. Splunk advisory SVD-2026-1011 (2026-10-21) lists Splunk SOAR below 8.7.0, fixed 8.7.0; one of 8 grouped CWE CVEs. No exploitation or PoC found; did not search social posts.
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76530

## Documents

- [advisory] SVD-2026-1011 Security Hardening in Splunk SOAR - October 2026 https://advisory.splunk.com/advisories/SVD-2026-1011

## From the sources

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76530 are related to use of non-canonical URL paths for authorization decisions and are grouped under the Common Weakness Enumeration (CWE) CWE-647.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_