CVE-2026-76379: Cisco Webex SOAR Information Disclosure

CVE-2026-76379 Overview

CVE-2026-76379 is an information disclosure vulnerability in the Cisco Webex app for Splunk SOAR in versions prior to 2.2.1. The flaw allows an authenticated user with permission to run actions to view a sensitive meeting password in cleartext through the Splunk SOAR user interface. The issue occurs because the schedule meeting action does not mark its password parameter as a password field, so the value is not masked. The vulnerability is categorized under CWE-312: Cleartext Storage of Sensitive Information.

Critical Impact
An authenticated Splunk SOAR user with action-execution privileges can retrieve Webex meeting passwords in cleartext, undermining the confidentiality of scheduled meetings.

Affected Products

Cisco Webex app for Splunk SOAR versions below 2.2.1
Splunk SOAR deployments integrating the Cisco Webex app
Any environment where the schedule meeting action is executed via the affected app

Discovery Timeline

2026-08-19 - CVE-2026-76379 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76379

Vulnerability Analysis

The Cisco Webex app for Splunk SOAR exposes a schedule meeting action that accepts a meeting password as an input parameter. In releases prior to 2.2.1, this parameter is not flagged as a password type within the app manifest. As a result, the Splunk SOAR interface renders the value as plain text rather than masking it in the action console and audit views.

Any authenticated user assigned a role with the run actions permission can trigger the action and observe the cleartext password. The disclosure extends to logs and UI elements that record action parameters, broadening exposure beyond the immediate operator. The vulnerability requires authentication and low privileges, and does not affect integrity or availability.

Root Cause

The root cause is a missing parameter type declaration in the Cisco Webex app definition. Splunk SOAR relies on the app to identify sensitive fields so the platform can mask them at input and in the UI. Because the schedule meeting action omits this designation, Splunk SOAR treats the password like any other string parameter and displays it in cleartext.

Attack Vector

Exploitation is network-based but requires an authenticated Splunk SOAR account with action-execution rights. An attacker with such access invokes the schedule meeting action and reads the meeting password from the action results or audit history. No user interaction from the meeting owner is required, and no code execution is involved. See the Splunk Security Advisory SVD-2026-0806 for vendor details.

Detection Methods for CVE-2026-76379

Indicators of Compromise

Execution records of the Cisco Webex schedule meeting action containing cleartext password values in parameter fields.
Splunk SOAR audit entries showing action invocations by unexpected user accounts or roles.
Anomalous access patterns to action history or playbook results by low-privilege users.

Detection Strategies

Review Splunk SOAR action history for calls to the Cisco Webex app's schedule meeting action and identify any records containing password parameter values.
Correlate action-execution events with user role assignments to flag executions by accounts that should not manage Webex meetings.
Search app playbook logs for occurrences of the parameter name associated with the meeting password.

Monitoring Recommendations

Enable and forward Splunk SOAR audit logs to a centralized log store for retention and review.
Alert on newly granted run actions role permissions that expand access to the Cisco Webex app.
Monitor the installed Cisco Webex app version and alert if it remains below 2.2.1.

How to Mitigate CVE-2026-76379

Immediate Actions Required

Upgrade the Cisco Webex app for Splunk SOAR to version 2.2.1 or later on all Splunk SOAR instances.
Rotate any Webex meeting passwords that may have been scheduled through the affected app while the vulnerable version was in use.
Review and restrict Splunk SOAR roles that hold the run actions permission to only trusted operators.

Patch Information

Splunk has addressed the issue in Cisco Webex app for Splunk SOAR version 2.2.1. Refer to the Splunk Security Advisory SVD-2026-0806 for the fixed release and installation guidance.

Workarounds

Limit the run actions permission to a minimal set of trusted administrators until the upgrade is applied.
Avoid scheduling Webex meetings through the Splunk SOAR integration until the patched version is deployed.
Purge or restrict access to action history entries that contain cleartext meeting passwords.

bash

# Review installed Splunk SOAR app version (run on the SOAR host)
phenv python -c "import json,glob,os; \
[print(os.path.basename(os.path.dirname(f)), json.load(open(f)).get('app_version')) \
for f in glob.glob('/opt/phantom/apps/*/*.json') if 'webex' in f.lower()]"