CVE-2026-76367: Splunk SOAR Stored XSS Vulnerability

CVE-2026-76367 Overview

CVE-2026-76367 is a stored Cross-Site Scripting (XSS) vulnerability in Splunk SOAR versions below 8.6.0. A user holding the Incident Commander role can embed JavaScript inside a note. Splunk SOAR then treats the existing note content as Hypertext Markup Language (HTML) without sanitization when the note format changes. The injected script executes in another user's browser when that user opens the note. Exploitation requires social engineering: the attacker must phish the affected user into initiating a request within their browser. The vulnerability is classified under [CWE-79].

Critical Impact
An authenticated Incident Commander can execute arbitrary JavaScript in a victim's browser session, enabling limited confidentiality and integrity impact within the Splunk SOAR web interface.

Affected Products

Splunk SOAR versions below 8.6.0
Splunk SOAR (on-premises deployments)
Splunk SOAR Cloud (per vendor advisory scope)

Discovery Timeline

2026-08-19 - CVE-2026-76367 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76367

Vulnerability Analysis

The flaw resides in how Splunk SOAR renders note content when the note format is changed. Splunk SOAR reinterprets previously stored note content as HTML during the format transition. The application does not sanitize the pre-existing content before rendering it in the new format. An Incident Commander who stored JavaScript in a note can therefore trigger script execution in the DOM of any user who subsequently opens that note.

The stored payload persists on the server and executes in the victim's authenticated browser context. Impact is bounded because exploitation requires an elevated Incident Commander role, high attack complexity, and user interaction from the victim.

Root Cause

The root cause is missing output encoding when the note-rendering path switches formats. Splunk SOAR trusts previously stored note content as safe HTML rather than treating it as untrusted input requiring sanitization. This violates the principle of contextual output encoding for user-supplied data rendered in a browser.

Attack Vector

An attacker with Incident Commander privileges stores a JavaScript payload inside a note. The attacker then phishes a target user, tricking them into initiating a request in their browser that changes the note format or opens the note under conditions that trigger HTML rendering. When the victim's browser processes the note, the injected script executes in the victim's session. The vendor advisory notes that an Incident Commander cannot exploit the flaw at will, indicating exploitation depends on external user interaction. See the Splunk Security Advisory SVD-2026-0804 for vendor details.

Detection Methods for CVE-2026-76367

Indicators of Compromise

Note records containing HTML tags such as <script>, <img onerror=>, or <svg onload=> in the Splunk SOAR database
Audit log entries showing note format changes performed by Incident Commander accounts followed by note-open events from other users
Unexpected outbound requests originating from the Splunk SOAR web UI to attacker-controlled domains

Detection Strategies

Query note storage for content matching common XSS payload patterns, including event handlers and script tags
Correlate note create, edit, and format-change events with the accounts that performed them to identify anomalous behavior by Incident Commander users
Review browser Content Security Policy (CSP) violation reports if CSP reporting is enabled for the Splunk SOAR interface

Monitoring Recommendations

Enable detailed audit logging for note operations and forward logs to a centralized SIEM for retention and search
Alert on note format transitions performed shortly before a different user views the same note
Monitor Incident Commander role assignments and flag any additions outside of change-controlled workflows

How to Mitigate CVE-2026-76367

Immediate Actions Required

Upgrade Splunk SOAR to version 8.6.0 or later as directed by the vendor advisory
Audit all accounts currently holding the Incident Commander role and remove unnecessary grants
Review existing notes for suspicious HTML or JavaScript content and remediate affected records

Patch Information

Splunk has released a fix in Splunk SOAR version 8.6.0. Refer to the Splunk Security Advisory SVD-2026-0804 for full remediation guidance and version details.

Workarounds

Restrict the Incident Commander role to a minimal set of trusted users following the guidance in Splunk's documentation on managing roles and permissions
Train users to avoid clicking unsolicited links that initiate requests against the Splunk SOAR interface
Enforce a strict Content Security Policy on the Splunk SOAR web interface where supported to limit inline script execution

bash

# Configuration example: verify installed Splunk SOAR version before and after upgrade
sudo -u splunk /opt/phantom/bin/phenv python -c "import phantom; print(phantom.__version__)"