High [CVE-2026-76357] Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAR
This high-severity Splunk advisory covers CVE-2026-76357 affecting Splunk SOAR.
Android app · Google Play
Monitor future Splunk CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the Representational State Transfer (REST) API and execute arbitrary code.
The vulnerability is possible because the REST API does not require an assigned role for the request and does not restrict the user-supplied file path to the intended temporary directory. For more information see Manage roles and permissions in Splunk SOAR (On-premises) ( ) and Splunk SOAR (On-premises) security information ( ) in the Splunk documentation.
- Splunk SOAR 8.6 before 8.6.0
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- The vulnerability is possible because the REST API does not require an assigned role for the request and does not restrict the user-supplied file path to the intended temporary directory.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.