CVE-2026-76364: Splunk SOAR SQL Injection Vulnerability

CVE-2026-76364 Overview

CVE-2026-76364 is a SQL injection vulnerability in Splunk SOAR versions below 8.6.0. An authenticated user holding the Automation Engineer role can execute arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database. The flaw resides in how Splunk SOAR processes custom function results, where the application concatenates a supplied name into a database lookup instead of using a bound SQL parameter. Successful exploitation exposes all data stored in the Splunk SOAR database and undermines system integrity. The vulnerability is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
An authenticated Automation Engineer can read and modify arbitrary data in the Splunk SOAR database, compromising the confidentiality and integrity of automation playbooks, cases, and stored secrets.

Affected Products

Splunk SOAR versions below 8.6.0
Splunk SOAR (On-Premises) deployments running vulnerable releases
Splunk SOAR Cloud instances prior to the vendor-applied fix

Discovery Timeline

2026-08-19 - CVE-2026-76364 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76364

Vulnerability Analysis

The vulnerability stems from unsafe SQL query construction inside the custom function results handler in Splunk SOAR. The application builds a database lookup by string-concatenating a caller-supplied name value directly into a SQL statement. Because the value is not passed as a bound parameter, an attacker controls the structure of the executed query.

Exploitation requires authentication with the Automation Engineer Splunk SOAR role. That role is intended to develop and manage automation playbooks and custom functions, so the ability to reach the vulnerable code path is expected in normal usage. The defect converts a legitimate function into a primitive for arbitrary SQL execution against the underlying database.

An attacker who exploits the flaw can read every table in the Splunk SOAR database, including playbook definitions, case data, asset configurations, and any secrets stored by the platform. Because the injection executes with the database user privileges of the SOAR application, attackers can also UPDATE and DELETE records, tampering with automation logic and investigation records.

Root Cause

The root cause is failure to use parameterized queries, classified as [CWE-89]. The custom function results code path treats the name field as trusted input and interpolates it into a SQL statement. Splunk's advisory confirms the fix replaces string concatenation with a bound SQL value.

Attack Vector

The attack vector is network-based and requires an authenticated session with Automation Engineer privileges. An attacker submits a crafted name payload through the custom function results interface. The Splunk SOAR backend concatenates the payload into a SQL query executed against the SOAR database. No user interaction is required beyond the attacker's own authenticated request.

No public proof-of-concept exploit is listed in the enriched data, and no verified code examples are available. Refer to the Splunk Security Advisory SVD-2026-0804 for vendor-supplied technical details.

Detection Methods for CVE-2026-76364

Indicators of Compromise

Custom function result submissions containing SQL metacharacters such as single quotes, --, ;, UNION, or SELECT in the name field.
Unexpected database queries in PostgreSQL logs that reference SOAR tables outside of normal automation activity.
Automation Engineer accounts performing custom function operations at atypical hours or from unusual source addresses.
New or modified playbooks, assets, or user records that cannot be tied to a legitimate change ticket.

Detection Strategies

Enable and centralize PostgreSQL query logging for the Splunk SOAR database, then alert on queries that deviate from the application's parameterized query patterns.
Review Splunk SOAR audit logs for custom function result activity performed by Automation Engineer accounts and correlate with source IP and session context.
Baseline normal API request bodies to the custom function results endpoint and flag payloads containing SQL syntax in the name parameter.

Monitoring Recommendations

Forward Splunk SOAR application logs, web server logs, and database logs to a centralized analytics platform for correlation.
Monitor for privilege changes that grant the Automation Engineer role to new or dormant accounts.
Track authentication events for accounts holding automation privileges and alert on session anomalies such as impossible travel or new user agents.

How to Mitigate CVE-2026-76364

Immediate Actions Required

Upgrade Splunk SOAR to version 8.6.0 or later on all On-Premises deployments. Splunk SOAR Cloud tenants receive the fix directly from the vendor.
Audit all accounts assigned the Automation Engineer role and revoke the assignment where it is not required for the user's job function.
Rotate credentials, API tokens, and asset secrets stored in the Splunk SOAR database if compromise is suspected.
Review recent playbook, asset, and case modifications for unauthorized changes.

Patch Information

Splunk has released a fixed version of Splunk SOAR that binds the supplied name value as a SQL parameter rather than concatenating it into the query. Apply the update referenced in Splunk Security Advisory SVD-2026-0804. Splunk SOAR Cloud customers should confirm their tenant is running a fixed build with Splunk Support.

Workarounds

Restrict the Automation Engineer role to a minimal set of trusted users until the patch is deployed. See Manage roles and permissions in Splunk SOAR (Cloud) for role management guidance.
Place Splunk SOAR management interfaces behind network access controls that limit exposure to trusted administrative networks.
Enable multi-factor authentication for all accounts that hold automation privileges.