CVE-2026-76372: Nmap Scanner for Splunk SOAR RCE Flaw

CVE-2026-76372 Overview

CVE-2026-76372 affects the Nmap Scanner connector for Splunk SOAR in versions below 3.0.15. The connector's action manifest classifies the scan network action as read-only, but the action accepts Nmap Scripting Engine (NSE) script parameters that can perform write operations. A Splunk SOAR user with permission to edit, create, or run playbooks can invoke scan network inside a Safe Mode playbook and use NSE scripts to execute commands or modify state on a target system. The flaw stems from an incorrect permission classification [CWE-732].

Critical Impact
An authenticated playbook author can bypass Safe Mode restrictions and achieve command execution on scanned hosts through NSE scripts.

Affected Products

Splunk SOAR Nmap Scanner connector, versions below 3.0.15
Splunk SOAR Cloud deployments using the affected connector
Splunk SOAR on-premises deployments using the affected connector

Discovery Timeline

2026-08-19 - CVE-2026-76372 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76372

Vulnerability Analysis

Splunk SOAR uses playbook Safe Mode to restrict actions to those marked read-only in the connector manifest. Safe Mode is intended to allow investigation without state-changing effects on external systems. The Nmap Scanner connector below version 3.0.15 declares the scan network action as read-only. That declaration does not reflect the action's real capability, because it accepts arbitrary NSE script arguments.

NSE scripts can perform write operations against target hosts. Available script categories include intrusive, exploit, and vuln, and many scripts issue authenticated commands, brute-force credentials, or modify service state. Marking the action read-only allows Safe Mode playbooks to run it without additional review, defeating the control.

Root Cause

The root cause is an incorrect permission classification in the connector's action manifest [CWE-732: Incorrect Permission Assignment for Critical Resource]. The manifest treats scan network as read-only based on the primary scanning function while ignoring the write potential introduced by user-supplied NSE script parameters.

Attack Vector

Exploitation requires an authenticated SOAR user holding a role with playbook edit, create, or run privileges. The user constructs or modifies a Safe Mode playbook that calls the scan network action with a chosen NSE script and script arguments. When the playbook executes, the Nmap Scripting Engine runs the script against the target and can issue commands or alter state. The attack traverses a trust boundary between the SOAR platform and downstream targets, which is why the CVSS scope is marked as changed.

Refer to the Splunk Security Advisory SVD-2026-0806 for vendor-supplied technical details.

Detection Methods for CVE-2026-76372

Indicators of Compromise

Nmap Scanner connector versions below 3.0.15 present in the Splunk SOAR app repository
Playbook run history showing scan network actions invoked with NSE --script arguments in Safe Mode contexts
Nmap process invocations on SOAR automation nodes that include intrusive, exploit, vuln, or brute script categories

Detection Strategies

Audit installed SOAR connector versions and flag any Nmap Scanner instance below 3.0.15.
Review playbook JSON and version history for scan network action calls that pass script or script-args parameters.
Correlate SOAR audit logs with target-system telemetry to identify state changes that follow a Safe Mode playbook execution.

Monitoring Recommendations

Enable and centralize Splunk SOAR audit logging for playbook edits, executions, and action parameters.
Monitor endpoint telemetry on hosts targeted by SOAR scans for unexpected process creation, service changes, or credential activity originating from SOAR scan windows.
Alert on new or modified playbooks that invoke the Nmap Scanner scan network action with non-default parameters.

How to Mitigate CVE-2026-76372

Immediate Actions Required

Upgrade the Nmap Scanner connector to version 3.0.15 or later on all Splunk SOAR instances.
Review existing playbooks for scan network invocations that pass NSE script parameters and remove or restrict them.
Restrict playbook edit, create, and run roles to trusted personnel and enforce least privilege on SOAR RBAC assignments.

Patch Information

Splunk has released Nmap Scanner connector version 3.0.15, which corrects the action manifest so that scan network is no longer classified as read-only when script parameters may perform write operations. Details are published in Splunk Security Advisory SVD-2026-0806.

Workarounds

Disable the Nmap Scanner connector on SOAR instances until the patched version is installed.
Remove Safe Mode designations from playbooks that call scan network and require manual approval for those runs.
Restrict outbound network reachability from SOAR automation nodes to scoped scan targets only.

bash

# Verify Nmap Scanner connector version on a Splunk SOAR host
phenv python -c "import json; print(json.load(open('/opt/phantom/apps/nmap_scanner/nmap_scanner.json'))['app_version'])"

# Example RBAC review: list roles with playbook edit privileges via SOAR REST API
curl -k -u "$SOAR_USER:$SOAR_TOKEN" \
  "https://soar.example.com/rest/role?_filter_permissions__contains='playbook'"