Skip to content

CVE-2026-76408

Splunk SOAR resource lifetime flaw allows unauthenticated compromise (CVE-2026-76408)

Critical 9.8 Vendor: Cisco Published

A critical resource lifetime vulnerability in Splunk SOAR before 8.7.0 can be exploited over the network without credentials, potentially giving an attacker full control. Upgrade to Splunk SOAR 8.7.0. (CVE-2026-76408)

What happened

CVE-2026-76408 is a critical vulnerability in Splunk SOAR caused by improper control of a resource through its lifetime (CWE-664). It is reachable over the network and can be exploited without authentication or user interaction, with low attack complexity. A successful attack could undermine the confidentiality, integrity and availability of the affected system, which is reflected in the CVSS 3.1 score of 9.8.

The published advisory describes this as the result of an internal security review and a software hardening release that addresses multiple internally discovered vulnerabilities. There is no indication that the vulnerability has been exploited in the wild, and it is not listed in CISA's KEV catalogue.

Who is affected

Splunk SOAR versions before 8.7.0 are affected. The fixed release named in the advisory is Splunk SOAR 8.7.0. Any organisation running an earlier version of Splunk SOAR should treat this as applying to them.

What to do now

  1. Confirm which Splunk SOAR versions you are running. Any version before 8.7.0 is affected.
  2. Upgrade each affected instance to Splunk SOAR 8.7.0, the fixed release.
  3. The advisory does not list a workaround, so treat the upgrade as the primary remediation and do not rely on configuration changes as a substitute.
  4. After upgrading, verify the new version and review the instance for unexpected changes that may have occurred before the fix.

How to detect it

No indicators of compromise are listed in the advisory.

Beyond the patch

This is a critical, network-reachable flaw in a security operations platform, and the fix is a patch-cycle challenge: you need to know where Splunk SOAR is running and bring it to 8.7.0 before an attacker can reach it. Supply Chain Defense & Third-Party Risk can help you track supplier software and how quickly fixes arrive, while Virtual CISO Services (vCISO) can help you find and reduce exposed management interfaces so the next network-reachable flaw is not as easy to target.

Affected and fixed versions

ProductAffectedFixed in
Splunk SOAR– < 8.7.08.7.0

References

Part of this release

Cisco vulnerabilities, week 43 of 2026: eight critical flaws lead 65 CVEs

More from Cisco

Splunk SOAR improper path protection lets unauthenticated network attackers achieve full compromise (CVE-2026-76529)Splunk SOAR exception handling flaw allows unauthenticated full compromise (CVE-2026-76527)Cisco Secure Firewall ASA and FTD SSL VPN denial of service under active exploitation (CVE-2026-76418)Splunk Enterprise protection mechanism failure allows unauthenticated network compromise (CVE-2026-76301)
← All vulnerability advisories

Sources: the CVE record (MITRE), NVD, CISA KEV and SSVC, ENISA EUVD, FIRST EPSS and the vendor's own advisory. Scores and dates are shown as those sources publish them.

Written with AI assistance from the sources above and checked automatically against them before publication.