Splunk SOAR unauthenticated critical exception handling flaw (CVE-2026-76527)

What happened

Splunk SOAR before 8.7.0 contains an improper check or handling of exceptional conditions (CWE-703). The flaw can be reached over the network with low attack complexity, no privileges, and no user interaction. A successful exploit can have high impact on confidentiality, integrity, and availability. The CVSS v3.1 score is 9.8, rated critical.

Cisco's description states that the issue was found during an internal security review and addressed in a software hardening release that covers multiple internally discovered vulnerabilities. The associated SSVC assessment records exploitation as none, automatable as yes, and technical impact as total. No public disclosure or exploitation is reported, and the flaw is not listed in CISA's KEV catalogue.

Who is affected

Splunk SOAR is the affected product. Every release before 8.7.0 is in scope; the fixed release is Splunk SOAR 8.7.0. Organisations running an earlier version should give the upgrade priority because the vulnerability requires no credentials and can be reached from the network.

What to do now

1. Upgrade Splunk SOAR to 8.7.0, the fixed release named in the CVE record.
2. Until the upgrade is complete, restrict network access to Splunk SOAR to trusted management networks or a VPN. Because the flaw requires no credentials and no user interaction, reducing exposure is the main containment step.
3. After upgrading, verify the reported version on every Splunk SOAR instance to confirm it is at least 8.7.0.
4. Review Splunk's advisory referenced on this page for any additional details. No separate workaround is listed.

Beyond the patch

Because this is an unauthenticated, network-reachable flaw in a SOAR platform, the first task is to find every Splunk SOAR instance and check whether it is reachable from anything other than a trusted management network. Virtual CISO Services (vCISO) can help scope that exposure and prioritise patching. Patching also depends on a supplier's release cycle, so maintaining visibility of the software you run and how quickly vendors fix critical issues is a supply-chain risk management problem; Supply Chain Defense & Third-Party Risk helps build that process.