Splunk SOAR improper alternate path protection allows unauthenticated network compromise (CVE-2026-76529)

What happened

During an internal security review, Cisco found an improper protection of an alternate path, tracked as CWE-424, in Splunk SOAR. The flaw is rated critical under CVSS 3.1 with a score of 9.8.

The CVSS vector means the issue can be exploited from the network with low attack complexity, no privileges and no user interaction. A successful attack can have high impact on confidentiality, integrity and availability.

The flaw is assessed as automatable with total technical impact. The CVE record does not report exploitation or public disclosure for CVE-2026-76529.

Who is affected

All Splunk SOAR versions before 8.7.0 are affected. The fixed release is Splunk SOAR 8.7.0. Splunk SOAR is a security orchestration, automation and response platform, so installations often hold integrations with security tools and sensitive operational data. Any instance running an earlier release is within the affected range, regardless of whether it is internet-facing or internal.

What to do now

1. Upgrade to Splunk SOAR 8.7.0. That is the fixed release.
2. If patching cannot be done immediately, restrict network access to Splunk SOAR. This issue is reachable from the network without credentials, so management interfaces and automation endpoints should not be on uncontrolled or untrusted networks.
3. Review all deployments, including non-production and recovery instances, for versions before 8.7.0.
4. After patching, verify integrations still work and review recent automation activity for anything unexpected. No vendor workaround is listed for this CVE.

Beyond the patch

Beyond the upgrade, this is a reminder that network-reachable systems inside the security stack need the same exposure discipline as internet-facing services. An unpatched orchestrator is a path to the tools and automations it controls. Virtual CISO Services can help bring that internal attack surface into a regular exposure review. Because the remediation depends on a supplier release, tracking Splunk SOAR versions and patch lead times should sit inside Supply Chain Defense & Third-Party Risk.