CVE-2026-76377 Overview
CVE-2026-76377 is an information disclosure vulnerability in the Azure AD Graph app for Splunk SOAR in versions below 2.5.3. The app's reset password action fails to mark the temp_password parameter as a password field. As a result, the temporary password is rendered in cleartext within the Splunk SOAR user interface. A user holding a role with permission to run actions can invoke the action and view the sensitive credential. The weakness is categorized as CWE-312: Cleartext Storage of Sensitive Information.
Critical Impact
Authenticated SOAR users with action-run privileges can view temporary Azure AD passwords in cleartext through the UI, enabling credential theft and lateral movement into Azure AD tenants.
Affected Products
- Splunk SOAR — Azure AD Graph app versions below 2.5.3
- Splunk SOAR On-Premises (when the vulnerable app is installed)
- Splunk SOAR Cloud (when the vulnerable app is installed)
Discovery Timeline
- 2026-08-19 - CVE-2026-76377 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76377
Vulnerability Analysis
The Azure AD Graph app for Splunk SOAR provides automation actions that interact with Microsoft Entra ID (formerly Azure AD). One of these actions, reset password, accepts a temp_password parameter used to set a new temporary credential for a target user. Splunk SOAR relies on action parameter metadata to determine how values are rendered in the interface. Parameters flagged as password fields are masked; parameters lacking that flag are displayed in cleartext. The Azure AD Graph app did not mark temp_password as a password parameter, so its value was written to action results and rendered as plain text.
Any SOAR user permitted to run actions could invoke the workflow, and the temporary password would be visible in the action output view. The disclosure extends to any interface or export that renders action parameters, expanding exposure beyond the initiating analyst.
Root Cause
The root cause is missing sensitivity metadata on an action parameter. The app manifest for reset password did not designate temp_password with the password data type, so the SOAR platform did not apply masking or redaction. This is a classic implementation of CWE-312, where sensitive data is stored and displayed without protective handling.
Attack Vector
Exploitation requires an authenticated Splunk SOAR user with a role that grants permission to run actions. The attacker executes the Azure AD Graph app's reset password action against a target identity, either through the web UI or through documented action-run interfaces. The resulting temporary password is displayed in cleartext in the action results panel. The attacker can then use the disclosed credential to authenticate to the target Azure AD account, pivot to cloud resources, or persist within the tenant. No exploit code is required. Details on invoking SOAR actions are covered in Splunk's documentation for running actions in Splunk SOAR.
Detection Methods for CVE-2026-76377
Indicators of Compromise
- Unexpected invocations of the Azure AD Graph app reset password action in SOAR audit logs.
- Azure AD sign-in events for accounts that were recently the subject of a password reset action, originating from unusual IP addresses or user agents.
- SOAR action results containing readable password strings for the temp_password field prior to upgrading to version 2.5.3.
- Access to action result views by SOAR users who did not author or approve the workflow.
Detection Strategies
- Correlate Splunk SOAR audit logs with Entra ID sign-in logs to identify sessions that followed a reset password action within a short time window.
- Alert on any execution of the Azure AD Graph app on hosts running app versions below 2.5.3.
- Review role assignments to identify users who hold action-run permissions but do not require Azure AD reset capabilities.
Monitoring Recommendations
- Ingest Splunk SOAR audit and action logs into a centralized SIEM for cross-source correlation with Azure AD activity.
- Monitor Entra ID for password reset events, followed by successful authentications from new devices or geographies.
- Track installed SOAR app versions and generate alerts when vulnerable versions are detected.
How to Mitigate CVE-2026-76377
Immediate Actions Required
- Upgrade the Azure AD Graph app for Splunk SOAR to version 2.5.3 or later on all SOAR instances.
- Rotate any Azure AD passwords that were set through the vulnerable action while previous app versions were in use.
- Review Splunk SOAR role assignments and restrict action-run permissions to users who require them.
- Purge or restrict access to historical action results that may contain cleartext temp_password values.
Patch Information
Splunk addressed the issue in Azure AD Graph app version 2.5.3 by marking the temp_password action parameter as a password field, which enables masking in the SOAR UI and downstream views. Refer to the Splunk Security Advisory SVD-2026-0806 for the official fix guidance and download details.
Workarounds
- Restrict the run action role permission to a limited set of trusted analysts until the app is upgraded.
- Disable or remove the Azure AD Graph app if it is not required for active playbooks.
- Enforce out-of-band password rotation so that credentials set via SOAR are changed by the target user upon first sign-in.
- Audit and purge historical action result data that contains cleartext temporary passwords.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
