Splunk SOAR protection mechanism failure allows unauthenticated compromise (CVE-2026-76528)

What happened

Cisco's internal security review identified a protection mechanism failure in Splunk SOAR, tracked as CVE-2026-76528 and classified under CWE-693. Cisco describes this as one of multiple internally discovered vulnerabilities addressed in a software hardening release. CWE-693 is a class of protection mechanism failure, so the published details do not identify a single vulnerable component. According to the CVSS 3.1 vector, the flaw is reachable over the network, requires no privileges and no user interaction, and can result in a complete loss of confidentiality, integrity and availability. Cisco scores it 9.8, critical.

The CVE record does not list known exploitation or public disclosure. Cisco has not published a workaround for this vulnerability.

Who is affected

Splunk SOAR releases before 8.7.0 are affected. If you run any version prior to 8.7.0, treat this as applicable to your deployment. Cisco has not listed other products as affected. Check your asset inventory or vulnerability scanner coverage for Splunk SOAR instances and prioritise internet-facing deployments.

What to do now

1. Upgrade to Splunk SOAR 8.7.0. This is the fixed release named in the advisory.
2. Until the upgrade is complete, limit network access to the Splunk SOAR web interface and APIs so they are reachable only from trusted management networks. This is a temporary containment measure, not a replacement for the update.
3. Re-check the published advisory for any follow-up vendor guidance; no workaround is currently listed.

How to detect it

Because this is exploitable over the network without authentication, begin by identifying any Splunk SOAR instance reachable from the internet or other untrusted networks. Prioritise deployments where the management interface or API is exposed without an additional access-control layer in front of it. Treat internet-facing instances as the immediate priority.

Beyond the patch

CVE-2026-76528 shows how a network-reachable, unauthenticated flaw in an orchestration platform becomes an organisation-wide exposure if the service is left reachable. Our Virtual CISO Services help you find exposed services and open ports before they become incident triggers, and Supply Chain Defense & Third-Party Risk tracks suppliers' patch cycles so you know your exposure window as soon as a fix is announced.