CVE-2026-76357: Splunk SOAR RCE Vulnerability

CVE-2026-76357 Overview

CVE-2026-76357 affects Splunk SOAR (Security Orchestration, Automation, and Response) versions below 8.6.0. An authenticated user with no role assigned can submit a crafted file path to the Representational State Transfer (REST) API and execute arbitrary code. The REST API does not require an assigned role for the request and does not restrict the user-supplied file path to the intended temporary directory. The flaw is categorized as a path traversal issue [CWE-22] that leads to arbitrary code execution on the SOAR host.

Critical Impact
An authenticated but unprivileged Splunk SOAR account can execute arbitrary code on the platform, impacting confidentiality, integrity, and availability of automated security workflows.

Affected Products

Splunk SOAR (On-premises) versions below 8.6.0
Splunk SOAR REST API endpoints accepting file path parameters
Deployments granting API tokens or accounts to users without an assigned role

Discovery Timeline

2026-08-19 - CVE-2026-76357 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76357

Vulnerability Analysis

The vulnerability resides in a Splunk SOAR REST API endpoint that accepts a user-supplied file path. The endpoint expects file operations to occur within a designated temporary directory. Missing validation lets attackers submit paths that escape that directory. When the server processes the crafted path, it reads, writes, or executes files at attacker-chosen locations. The outcome is arbitrary code execution in the context of the SOAR service account.

The issue is compounded by a broken authorization check. The REST API does not require the caller to have an assigned role. Any authenticated principal, including provisioned users left without role assignment, can invoke the endpoint. This weakens the assumption that unassigned accounts are effectively inert.

Root Cause

Two defects combine to produce the impact. First, the REST API does not enforce role-based access control on the affected endpoint. Second, the endpoint fails to canonicalize and constrain user-supplied paths to the intended temporary directory. The result is a classic path traversal weakness [CWE-22] that reaches a file-handling code path capable of triggering execution.

Attack Vector

Exploitation requires network access to the Splunk SOAR REST API and valid authentication material for any user account, including one without an assigned role. An attacker submits an HTTP request containing a file path that traverses outside the temporary directory. The SOAR process then writes or loads content from an attacker-controlled location, resulting in code execution on the host. Refer to Splunk Security Advisory SVD-2026-0804 for vendor technical details.

No synthetic proof-of-concept is published here. Splunk documents the affected surface in the advisory linked above.

Detection Methods for CVE-2026-76357

Indicators of Compromise

REST API requests containing path traversal sequences such as ../ or absolute paths outside the SOAR temporary directory
Successful authenticated API calls originating from accounts that have no assigned role in Splunk SOAR
Unexpected files written outside the SOAR temporary directory or new executables in SOAR application paths
Child processes spawned by the SOAR service account that do not match normal playbook execution patterns

Detection Strategies

Enable REST API request logging on Splunk SOAR and alert on file path parameters containing traversal characters
Correlate authentication events with role assignment state to flag API activity from unassigned accounts
Baseline SOAR host processes and file writes, then alert on deviations that coincide with API activity

Monitoring Recommendations

Forward SOAR audit and web server logs to a central SIEM for retention and correlation
Monitor outbound network connections from the SOAR host for signs of command-and-control activity following API abuse
Review Splunk SOAR user inventory regularly and remove or disable accounts without an assigned role

How to Mitigate CVE-2026-76357

Immediate Actions Required

Upgrade Splunk SOAR (On-premises) to version 8.6.0 or later as directed by Splunk Security Advisory SVD-2026-0804
Audit all Splunk SOAR user accounts and remove or assign a least-privilege role to any account currently without a role
Rotate API tokens issued to accounts that lacked role assignments prior to remediation
Restrict network reachability of the SOAR REST API to trusted management networks

Patch Information

Splunk has released fixed builds in Splunk SOAR (On-premises) 8.6.0 and later. Administrators should follow the upgrade procedure documented by Splunk and validate that the REST API enforces role checks after upgrade. See Splunk Security Advisory SVD-2026-0804 for version-specific guidance.

Workarounds

Ensure every Splunk SOAR user account has an explicit role assigned, following the guidance in Splunk's Manage roles and permissions documentation
Place the SOAR REST API behind a reverse proxy or web application firewall that blocks path traversal patterns in request bodies and parameters
Limit network exposure of the SOAR management interface to a small set of administrative source addresses

bash

# Example: block requests containing path traversal sequences at an NGINX reverse proxy
location /rest/ {
    if ($request_uri ~* "(\.\./|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
    proxy_pass https://splunk-soar-backend;
}