Splunk SOAR exposes files or directories to external parties, letting authenticated attackers impact other resources (CVE-2026-76531)

What happened

Cisco describes CVE-2026-76531 as the result of a proactive internal security review that produced a software hardening release for Splunk SOAR. The weakness is assigned CWE-552, files or directories accessible to external parties. The CVE record does not name the specific directory or file path, but the classification means a resource that should be protected from external access is not.

The CVSS 3.1 rating is 9.9, critical. The vector records a network attack path with low attack complexity, low privileges required and no user interaction. The scope is changed, and the impact to confidentiality, integrity and availability is high. In practical terms, an authenticated attacker with only low-level access can reach files or directories that should be off limits and, because of the changed scope, cause high impact to other resources from there.

No exploitation has been publicly disclosed, and the CVE is not listed in CISA's KEV.

Who is affected

Splunk SOAR versions before 8.7.0 are affected. The fixed release is 8.7.0. Confirm which version you are running: everything earlier than 8.7.0 is in scope, regardless of deployment size.

SOAR platforms are used to orchestrate security response actions and often connect to the tools an organisation relies on. That makes this exposure more serious than one in a standalone application: a low-privileged account that can reach restricted files or directories may be able to move impact beyond the SOAR instance itself.

What to do now

1. Upgrade to Splunk SOAR 8.7.0. This is the fixed version listed for CVE-2026-76531 and the primary action.
2. No separate workaround is listed. While the upgrade is in progress, restrict network access to Splunk SOAR to trusted users and segments, and review which low-privileged accounts can authenticate.
3. After upgrading, confirm the deployment reports 8.7.0 and remove any temporary access restrictions once you have verified normal operations.

Beyond the patch

Beyond this single patch, the episode is a reminder that security tools are themselves part of the supply chain. Organisations rely on Splunk SOAR in incident response, but they also rely on Cisco's update cadence and their own asset tracking to close the gap when a fix appears. Tracking which suppliers' software you run, which versions are affected and how quickly you can roll out vendor fixes is exactly what Supply Chain Defense & Third-Party Risk is for. If Splunk SOAR is in your security stack, make sure it is identified in your supplier inventory and covered by the same update discipline you expect from every other system.