CVE-2026-76359: Splunk SOAR Path Traversal Vulnerability

CVE-2026-76359 Overview

CVE-2026-76359 is a path traversal vulnerability [CWE-22] in Splunk SOAR versions below 8.6.0. The flaw resides in the Universal Forwarder installer's archive extraction workflow. An authenticated user holding the Administrator role can craft archive members that escape the intended installation directory during extraction. Successful exploitation writes attacker-controlled files to arbitrary locations on the SOAR host.

The issue exists because the Universal Forwarder credentials-package extraction routine does not validate that each archive member remains within the destination directory before writing it to disk. Splunk assigned the vulnerability a CVSS 3.1 score of 6.5 and published mitigation guidance in advisory SVD-2026-0804.

Critical Impact
An authenticated Administrator can write files outside the Universal Forwarder installation directory, enabling tampering with system files and potential follow-on code execution on the Splunk SOAR host.

Affected Products

Splunk SOAR (On-premises) versions below 8.6.0
Splunk SOAR Universal Forwarder credentials-package extraction workflow
Deployments where non-trusted users hold the Administrator role

Discovery Timeline

2026-08-19 - CVE-2026-76359 published to the National Vulnerability Database
2026-08-20 - Record last modified in NVD

Technical Details for CVE-2026-76359

Vulnerability Analysis

The vulnerability affects the Universal Forwarder installer used by Splunk SOAR to forward SOAR data to a Splunk deployment. When an Administrator triggers the credentials-package workflow, SOAR extracts archive members to the intended installation directory. The extraction routine trusts filenames stored in archive headers without normalizing or validating them against the destination path.

An attacker with the Administrator role can build a malicious archive containing entries with relative path components such as ../ or absolute paths. During extraction, these entries traverse outside the target directory and land in arbitrary filesystem locations accessible to the SOAR service account.

Because the attack requires the Administrator role, exploitation is limited to accounts already granted elevated privileges within SOAR. The impact is still meaningful in environments where the Administrator role is delegated broadly or where SOAR runs with high host-level privileges.

Root Cause

The root cause is missing path validation in the archive extraction logic of the Universal Forwarder credentials-package workflow. The code writes each archive member using its embedded filename without verifying that the resolved destination remains within the intended installation directory. This is a canonical Zip Slip class flaw mapped to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires network access to the SOAR web interface and valid Administrator credentials. The attacker uploads or supplies a crafted Universal Forwarder credentials package containing archive entries with traversal sequences. Upon extraction, files are written to attacker-chosen paths, which can overwrite configuration files, drop executable content, or replace scripts loaded by privileged processes. No user interaction beyond the initial workflow invocation is required. Refer to the Splunk Security Advisory SVD-2026-0804 for vendor technical details.

Detection Methods for CVE-2026-76359

Indicators of Compromise

Unexpected files appearing outside the Universal Forwarder installation directory after a credentials-package operation
Splunk SOAR audit log entries showing Universal Forwarder credentials-package extraction initiated by non-standard Administrator accounts
Modification timestamps on system binaries, cron files, or service configuration files that correlate with SOAR extraction activity

Detection Strategies

Inspect SOAR audit logs for credentials-package upload and extraction events, correlating each event with the actor and source IP
Monitor the SOAR host filesystem for writes originating from the SOAR service account outside the expected installation path
Alert on archive files staged on the SOAR host that contain entries with ../ sequences or absolute paths

Monitoring Recommendations

Forward SOAR application and OS audit logs to a centralized SIEM for correlation and long-term retention
Enable file integrity monitoring on directories outside the Universal Forwarder install path that could be targeted by traversal, including /etc, /usr/local/bin, and service unit directories
Track Administrator role assignments and review changes on a scheduled cadence to enforce least privilege

How to Mitigate CVE-2026-76359

Immediate Actions Required

Upgrade Splunk SOAR (On-premises) to version 8.6.0 or later as documented in advisory SVD-2026-0804
Audit accounts holding the Administrator role and revoke assignments that are not strictly required
Review recent Universal Forwarder credentials-package activity for unexpected extractions or unknown source archives

Patch Information

Splunk resolved the vulnerability in Splunk SOAR (On-premises) 8.6.0. The fix adds validation that ensures each archive member remains within the intended destination directory before extraction. See the Splunk Security Advisory SVD-2026-0804 for upgrade instructions and version guidance.

Workarounds

Restrict the Administrator role to a minimal set of trusted operators until the upgrade is completed
Disable or avoid the Universal Forwarder credentials-package extraction workflow in environments that cannot be patched immediately
Isolate the SOAR host at the network layer to limit reachability from untrusted management workstations

bash

# Verify installed Splunk SOAR version and confirm it is 8.6.0 or later
sudo -u splunk /opt/phantom/bin/phenv python -c "import phantom; print(phantom.__version__)"

# Review current Administrator role assignments via the SOAR REST API
curl -k -u <admin_user> \
  "https://<soar-host>/rest/role?_filter_name=%22Administrator%22"