CVE-2026-76371 Overview
CVE-2026-76371 affects the FireAMP connector for Splunk SOAR in versions below 2.1.15. The FireAMP connector action manifest classifies the add listitem action as read-only, even though the action modifies file lists. A user with a role permitted to edit, create, or run playbooks can invoke add listitem inside a Safe Mode playbook and cause unauthorized changes to file lists. The issue is a permission assignment flaw tracked as [CWE-732].
Critical Impact
Authenticated Splunk SOAR users with playbook privileges can bypass Safe Mode restrictions to modify FireAMP file lists through a mislabeled read-only action.
Affected Products
- Splunk SOAR FireAMP connector versions below 2.1.15
- Splunk SOAR Cloud deployments using the FireAMP connector
- Splunk SOAR on-premises deployments using the FireAMP connector
Discovery Timeline
- 2026-08-19 - CVE-2026-76371 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76371
Vulnerability Analysis
Splunk SOAR playbooks support a Safe Mode setting that restricts execution to actions declared as read-only. Read-only actions are expected to query data without modifying downstream systems. The FireAMP connector ships an action manifest that determines which actions Safe Mode permits.
The manifest lists the add listitem action as read-only. In practice, add listitem writes new entries to FireAMP file lists, which control file allow and block decisions. Safe Mode therefore permits an action that changes security-relevant state. A user with playbook edit, create, or run privileges can exploit this gap without needing higher administrative rights.
Root Cause
The root cause is an incorrect permission assignment in the connector's action manifest metadata [CWE-732]. The manifest attribute that marks actions as read-only does not reflect the actual behavior of add listitem. Safe Mode enforcement relies on this manifest attribute as its authorization source, so the misclassification undermines the control.
Attack Vector
Exploitation requires an authenticated Splunk SOAR account with a role that can edit, create, or run playbooks. The attacker creates or modifies a playbook, enables Safe Mode, and adds the FireAMP add listitem action. When the playbook executes, Safe Mode allows the action and file list entries are added or updated in FireAMP. No user interaction is required beyond playbook execution. The vulnerability is described in the Splunk Security Advisory SVD-2026-0806.
Detection Methods for CVE-2026-76371
Indicators of Compromise
- Unexpected additions or modifications to FireAMP file lists that do not correlate with change management records.
- Splunk SOAR playbook execution logs showing the FireAMP add listitem action running inside Safe Mode playbooks.
- New or edited Safe Mode playbooks that reference the FireAMP connector's add listitem action.
Detection Strategies
- Audit Splunk SOAR playbook action history for calls to add listitem on the FireAMP connector and cross-reference against approved runs.
- Review recent playbook version history for additions of write-capable FireAMP actions by non-administrator users.
- Compare current FireAMP file list contents against a known-good baseline to identify unauthorized entries.
Monitoring Recommendations
- Forward Splunk SOAR audit and playbook execution logs to a SIEM and alert on FireAMP add listitem invocations.
- Enable change monitoring on FireAMP file lists and alert on additions sourced from the SOAR service account.
- Track privilege assignments granting playbook edit, create, or run roles and review them on a recurring basis.
How to Mitigate CVE-2026-76371
Immediate Actions Required
- Upgrade the Splunk SOAR FireAMP connector to version 2.1.15 or later.
- Restrict playbook edit, create, and run permissions to trusted operators only.
- Review existing Safe Mode playbooks for use of the FireAMP add listitem action and remove unauthorized instances.
Patch Information
Splunk has addressed the misclassification in FireAMP connector version 2.1.15. Refer to the Splunk Security Advisory SVD-2026-0806 for full remediation guidance and to the Splunk SOAR playbook settings documentation for Safe Mode configuration details.
Workarounds
- Disable or remove the FireAMP connector until it can be upgraded to a fixed version.
- Enforce approval workflows for any playbook that includes FireAMP actions.
- Reduce the number of accounts holding playbook authoring or execution privileges to the minimum required.
# Configuration example
# Verify the installed FireAMP connector version in Splunk SOAR
# Navigate to: Apps > Unconfigured Apps / Configured Apps > FireAMP
# Confirm the version is 2.1.15 or later before re-enabling Safe Mode playbooks.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
