---
id: "CVE-2026-76531"
kind: "vulnerability"
aliases: ["CVE-2026-76531"]
title: "Splunk SOAR: files and directories exposed to outside parties, fixed in 8.7.0"
severity: "critical"
cvss: 9.9
epss: 0.00378
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Splunk SOAR", "fixed": ["8.7.0"], "affected": "< 8.7.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cisco", "infrastructure", "self-hosted", "splunk", "splunk-soar", "vendor"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-21T23:17:30+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T07:15:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76531", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:25:12+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76531", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Splunk SOAR: files and directories exposed to outside parties, fixed in 8.7.0

Splunk SOAR versions before 8.7.0 expose files or directories to external parties, per CWE-552. Sources do not say which files or what an attacker can read or change with them.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Splunk SOAR affected < 8.7.0 fixed 8.7.0

## How to check

Check the installed Splunk SOAR version (unknown exact command in sources); versions below 8.7.0 are affected.

## Fix

Upgrade Splunk SOAR to 8.7.0 or later.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76531
- 2026-10-23T22:25:12+00:00 analyst — Not a Cisco product flaw per se: Splunk (Cisco) advisory SVD-2026-1011 shows this is Splunk SOAR, fixed in 8.7.0. Batch of 8 CVEs, this one the CWE-552 group, CVSS 9.9. No exploitation or PoC found; did not search social posts. Per-CVE exploit details not published.
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76531

## Documents

- [advisory] SVD-2026-1011 Security Hardening in Splunk SOAR - October 2026 https://advisory.splunk.com/advisories/SVD-2026-1011

## From the sources

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76531 are related to files or directories accessible to external parties and are grouped under the Common Weakness Enumeration (CWE) CWE-552.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_