{"id":"CVE-2026-76531","kind":"vulnerability","aliases":["CVE-2026-76531"],"related":[],"title":"Splunk SOAR: files and directories exposed to outside parties, fixed in 8.7.0","description":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76531 are related to files or directories accessible to external parties and are grouped under the Common Weakness Enumeration (CWE) CWE-552.","summary":"Splunk SOAR versions before 8.7.0 expose files or directories to external parties, per CWE-552. Sources do not say which files or what an attacker can read or change with them.","severity":"critical","cvss":9.9,"epss":0.00378,"exploited":false,"exploited_at":null,"products":[{"name":"Splunk SOAR","fixed":["8.7.0"],"affected":"< 8.7.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco","infrastructure","self-hosted","splunk","splunk-soar","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":"Check the installed Splunk SOAR version (unknown exact command in sources); versions below 8.7.0 are affected.","fix":"Upgrade Splunk SOAR to 8.7.0 or later.","status":"open","published_at":"2026-10-21T23:17:30+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:32:41+00:00","updated_at":"2026-10-24T07:15:52+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T22:32:41Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Splunk SOAR to 8.7.0 or later.","reach":"unknown","title":"Splunk SOAR: files and directories exposed to outside parties, fixed in 8.7.0","impact":"high","summary":"Splunk SOAR versions before 8.7.0 expose files or directories to external parties, per CWE-552. Sources do not say which files or what an attacker can read or change with them.","category":"vendor","who_cares":["splunk-soar","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"unknown; sources do not say what data or control is reachable","analyst_note":"Find the Cisco advisory for CVE-2026-76531 to confirm which files are exposed, the attack prerequisites, and the exact affected versions.","how_to_check":"Check the installed Splunk SOAR version (unknown exact command in sources); versions below 8.7.0 are affected.","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000494,"input_tokens":3013,"output_tokens":386,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Cisco security advisory for CVE-2026-76531 (check sec.cisco.com) to identify the affected products, versions and fixed releases; the NVD entry gives no product.","search":"'-2026':14A,17A,100C '-552':45B,122C '-76531':15A,18A,101C '8.7.0':12A,35B 'access':108C 'address':90C 'attack':55B 'chang':59B 'cisco':21B,63C,73C 'commit':66C 'common':117C 'comprehens':77C 'conduct':75C 'cve':13A,16A,99C 'cwe':44B,120C,121C 'directori':5A,39B,107C 'discov':93C 'enumer':119C 'expos':6A,36B 'extern':41B,110C 'file':3A,37B,51B,105C 'fix':10A 'group':114C 'harden':87C 'host':25B 'infrastructur':22B 'intern':78C,92C 'multipl':91C 'ongo':65C 'outsid':8A 'part':61C 'parti':9A,42B,111C 'per':43B 'proactiv':68C 'product':71C 'qualiti':72C 'read':57B 'relat':103C 'releas':88C 'result':83C 'review':80C,82C 'say':49B 'secur':69C,79C 'self':24B 'self-host':23B 'soar':2A,20A,29B,32B 'softwar':86C 'sourc':46B 'splunk':1A,19A,26B,28B,31B 'splunk-soar':27B 'track':97C 'vendor':30B 'version':33B 'vulner':94C,96C 'weak':118C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T23:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76531","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76531","severity":null,"published_at":"2026-10-21T23:17:30+00:00","modified_at":"2026-10-22T16:57:10+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76531:219","url":null,"severity":null,"published_at":"2026-10-23T22:25:12+00:00","modified_at":"2026-10-23T22:25:12+00:00","first_seen_at":"2026-10-23T22:25:12+00:00","fetched_at":"2026-10-23T22:25:12+00:00","note":"Not a Cisco product flaw per se: Splunk (Cisco) advisory SVD-2026-1011 shows this is Splunk SOAR, fixed in 8.7.0. Batch of 8 CVEs, this one the CWE-552 group, CVSS 9.9. No exploitation or PoC found; did not search social posts. Per-CVE exploit details not published."},{"source":"epss","external_id":"CVE-2026-76531","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76531","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1432,"url":"https://advisory.splunk.com/advisories/SVD-2026-1011","title":"SVD-2026-1011 Security Hardening in Splunk SOAR - October 2026","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}