Splunk SOAR improper access control allows unauthenticated network attackers full compromise (CVE-2026-76407)

What happened

CVE-2026-76407 is an improper access control weakness (CWE-284) in Splunk SOAR. It was found during Cisco's internal security review and addressed in a software hardening release. An attacker can exploit it over the network with no credentials and no user interaction.

The CVSS v3.1 score is 9.8, or critical, with high impact on confidentiality, integrity and availability. SSVC rates the flaw as automatable with total technical impact. The CVE record reports no known exploitation or public disclosure.

Who is affected

Affected product: Splunk SOAR, all versions before 8.7.0. Organisations running Splunk SOAR should treat any instance earlier than 8.7.0 as affected.

What to do now

1. Upgrade to Splunk SOAR 8.7.0, the fixed release, as soon as possible. This is a software hardening release addressing multiple internally discovered vulnerabilities.
2. No workaround has been published for this access control flaw. Until patching, restrict network access to Splunk SOAR so it is reachable only from trusted management networks.
3. Confirm after upgrade that all instances are on 8.7.0 or later.

How to detect it

Because the flaw is reachable over the network without credentials, confirm whether any Splunk SOAR instance is reachable from the internet or other untrusted segments. Treat reachable instances as exposed until the upgrade to 8.7.0 is complete.

Beyond the patch

Patch first. Beyond this release, the longer-term control is visibility: a vulnerability that is remotely exploitable with no credentials means the exposure window is set by how quickly you find and close reachable management interfaces. Virtual CISO Services (vCISO) helps maintain an exposure management view of such services, while Supply Chain Defense & Third-Party Risk tracks vendor patch cycles across the software you rely on, so a hardening release like this one reaches the top of the queue.