CVE-2026-76527
Splunk SOAR exception handling flaw allows unauthenticated full compromise (CVE-2026-76527)
Splunk SOAR before 8.7.0 has a critical exception-handling flaw (CVSS 9.8) that an unauthenticated attacker can reach over the network to fully compromise affected systems. Upgrade to Splunk SOAR 8.7.0; no exploitation or public exploit is recorded.
What happened
Cisco has released a software hardening update for Splunk SOAR following an internal security review. The issue tracked as CVE-2026-76527 is an improper check or handling of exceptional conditions, grouped under CWE-703. The CVSS 3.1 rating of 9.8 reflects that the flaw can be reached over the network, needs no privileges or user interaction, and has high impact on confidentiality, integrity and availability. In practice, successful exploitation would allow an unauthenticated attacker to completely compromise the affected instance. The CVE record does not record any public disclosure or exploitation of this flaw.
Who is affected
Splunk SOAR versions before 8.7.0 are affected. As a SOAR platform, the product sits in the security operations path, so organisations should inventory every instance rather than assuming only internet-facing deployments matter. Anyone running an affected version with network access to the platform should treat the upgrade as urgent.
What to do now
- Upgrade all Splunk SOAR deployments to 8.7.0, the fixed release for CVE-2026-76527.
- Until the upgrade is complete, restrict network access to the platform so only trusted administrative networks can reach it.
- No vendor workaround has been published; the upgrade is the primary remediation.
How to detect it
Locate every Splunk SOAR instance and confirm whether it is running a version before 8.7.0. Then review network exposure, because the flaw is reachable without credentials. The available advisory does not list indicators of compromise.
Beyond the patch
Beyond this upgrade, a critical unauthenticated network-reachable flaw in a SOAR platform is an exposure-management problem as much as a patch problem. Virtual CISO Services provide the routine asset and exposure discovery that should flag an open service before a CVE forces an emergency change. And because the exposure window is set by the vendor's patch cycle, Supply Chain Defense & Third-Party Risk helps track which versions you run and how quickly fixes arrive. Apply the upgrade first, then make those processes part of normal operations.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Splunk SOAR | – < 8.7.0 | 8.7.0 |