CVE-2026-76373: Splunk SOAR AD LDAP Injection Vulnerability

CVE-2026-76373 Overview

CVE-2026-76373 is an LDAP injection vulnerability [CWE-90] in the Active Directory LDAP application for Splunk SOAR. Versions below 2.3.8 allow a user holding a role with permission to run actions to inject crafted input into Active Directory (AD) queries. Successful exploitation enables enumeration of AD objects, including accounts, groups, and organizational units. Attackers can also read sensitive attributes from arbitrary directory objects and redirect account modification actions to unintended targets. The flaw requires low-privilege authenticated access over the network and does not require user interaction.

Critical Impact
Authenticated SOAR users with action-execution rights can enumerate Active Directory objects, exfiltrate sensitive attributes, and redirect account modifications to unintended targets.

Affected Products

Splunk SOAR AD LDAP app versions below 2.3.8
Splunk SOAR on-premises deployments using the AD LDAP app
Splunk SOAR Cloud deployments using the AD LDAP app

Discovery Timeline

2026-08-19 - CVE-2026-76373 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76373

Vulnerability Analysis

The AD LDAP app for Splunk SOAR constructs Lightweight Directory Access Protocol (LDAP) queries using user-supplied input from action parameters. The app fails to properly sanitize or escape special LDAP metacharacters before passing them to the directory server. This mishandling allows an authenticated user to alter the intended query structure and scope.

When an attacker injects LDAP filter syntax into action inputs, the resulting query executes against Active Directory with the app's service account privileges. This broadens the query's effective scope beyond what the calling user should reach. The attacker can then enumerate objects, read attributes, or coerce modification actions against unintended distinguished names (DNs).

Root Cause

The root cause is improper neutralization of special elements used in an LDAP query [CWE-90]. The app concatenates or interpolates user input directly into LDAP filter strings without escaping characters such as *, (, ), \, and null bytes. Because LDAP filters use these characters as syntax, attacker-controlled input becomes part of the query logic.

Attack Vector

The attacker must authenticate to Splunk SOAR and hold a role permitted to run actions using the AD LDAP app. The attacker supplies crafted input to an action parameter, such as a username, group name, or search filter field. The app passes the input into an LDAP query, where injected filter syntax expands enumeration scope or redirects the target DN of a modification action. The vulnerability manifests in the app's action handlers that build LDAP filters. See the Splunk Security Advisory SVD-2026-0806 for vendor technical details.

Detection Methods for CVE-2026-76373

Indicators of Compromise

SOAR action logs containing unexpected LDAP filter metacharacters such as *, )(, or |( in user-supplied fields
Domain Controller directory service logs showing LDAP searches with unusually broad filters originating from the SOAR service account
Unexpected modify operations against AD objects that were not the intended target of a playbook
Sudden increases in LDAP search result volume tied to the AD LDAP app service account

Detection Strategies

Audit Splunk SOAR action history for AD LDAP actions containing LDAP filter syntax within input parameters
Correlate SOAR playbook run identifiers with Domain Controller event IDs 1644 and 4662 to identify anomalous queries
Alert on modifications to privileged AD groups or high-value accounts initiated by the SOAR service account outside of approved playbooks

Monitoring Recommendations

Enable LDAP diagnostic logging on Domain Controllers to capture expensive and inefficient searches from the SOAR service account
Forward SOAR action logs and Domain Controller security events to a central data lake for correlation
Baseline normal AD LDAP app query patterns and alert on deviations in filter structure or result cardinality

How to Mitigate CVE-2026-76373

Immediate Actions Required

Upgrade the AD LDAP app for Splunk SOAR to version 2.3.8 or later
Review all SOAR roles and remove action-execution permissions from users who do not require them
Audit recent AD LDAP app action history for signs of injected filter syntax or unintended modifications
Rotate credentials for the AD service account used by the AD LDAP app if abuse is suspected

Patch Information

Splunk has released a fixed version of the AD LDAP app. Upgrade to version 2.3.8 or later as described in the Splunk Security Advisory SVD-2026-0806.

Workarounds

Restrict the Splunk SOAR roles that hold action-execution privileges to a minimum set of trusted operators
Scope the AD service account used by the app with least-privilege permissions in Active Directory, limiting readable attributes and modifiable objects
Disable or uninstall the AD LDAP app until the patched version can be deployed if the app is not actively required

bash

# Verify the installed AD LDAP app version on Splunk SOAR
phenv python -c "import json,os; \
  p='/opt/phantom/apps'; \
  [print(d, json.load(open(os.path.join(p,d,'*.json')))['app_version']) \
   for d in os.listdir(p) if 'ldap' in d.lower()]"