Splunk SOAR resource lifetime flaw allows unauthenticated total compromise (CVE-2026-76408)

What happened

CVE-2026-76408 is one of multiple internally discovered vulnerabilities that Cisco addressed in a software hardening release. Cisco describes it as improper control of a resource through its lifetime, classified under CWE-664.

The CVSS 3.1 score is 9.8 (critical). The vector indicates the vulnerability is reachable over the network, requires low attack complexity, needs no privileges and no user interaction, and can lead to high impact on confidentiality, integrity and availability. The CVE record does not describe the precise resource lifetime issue beyond CWE-664.

No active exploitation is recorded for this vulnerability, and no CISA KEV entry is attached.

Who is affected

Splunk SOAR versions before 8.7.0 are affected. The fixed release is Splunk SOAR 8.7.0. Splunk SOAR is a security orchestration, automation and response platform, and affected deployments usually sit in the security operations stack holding privileged integrations with detection and response tools. If you run any earlier release, you are in scope.

What to do now

1. Upgrade affected Splunk SOAR installations to Splunk SOAR 8.7.0. This is the fixed release listed by Cisco.
2. Treat this as a priority upgrade: the vulnerability is reachable over the network without credentials or user interaction, and CVSS scores it at 9.8.
3. No workaround has been published. Until you can upgrade, restrict network access to Splunk SOAR to trusted management networks and monitor the platform for unexpected activity.

Beyond the patch

Beyond the patch, this is the kind of unauthenticated network exposure that a recurring external review should surface before a vendor advisory does. Our Virtual CISO Services keep that exposure picture current. It is also a supply-chain patch-cycle issue: organisations that do not track which vendors' software they run, and how quickly those vendors publish fixes, will stay exposed longer. Our Supply Chain Defense & Third-Party Risk service addresses that vendor risk.