CVE-2026-76364
CVE-2026-76364: 1 tracked advisory record across Splunk. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Splunk
1 advisory- Advisory severityMedium6.5
Medium [CVE-2026-76364] Structured Query Language (SQL) Injection through Custom Function Results in Splunk SOAR
CVE-2026-76364Source published Source updated
In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database through custom function results, allowing for reading all relevant data stored in the Splunk SOAR database and affecting system integrity. The SQL injection is possible because Splunk SOAR builds the database lookup with the supplied name instead of a bound SQL value. For more information see Manage roles and permissions in Splunk SOAR (Cloud) ( ) in the Splunk documentation.
- Affected products in this advisory
- Splunk SOAR
- Source-reported affected versions
- Splunk SOAR 8.6 before 8.6.0
- Source-reported fixed versions
- 8.6.0
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Android app · Google Play
Monitor future Splunk CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.