Splunk SOAR improper path protection lets unauthenticated network attackers achieve full compromise (CVE-2026-76529)

What happened

Cisco's internal security review identified an improper protection of alternate path (CWE-424) in Splunk SOAR. It is rated critical with a CVSS 3.1 score of 9.8. The vulnerability is reachable over the network with low attack complexity, requires no privileges, and needs no user interaction; a remote attacker who can reach an affected instance may cause high confidentiality, integrity, and availability impact.

The CVE record reports no known exploitation or public disclosure. The software hardening release for Splunk SOAR addresses this issue and multiple internally discovered vulnerabilities. The record does not describe the specific alternate path or the affected functions beyond CWE-424.

Who is affected

Splunk SOAR versions before 8.7.0 are affected. All releases prior to 8.7.0 are in scope. Organisations that operate Splunk SOAR should confirm their current version. No additional affected products are listed.

What to do now

1. Update Splunk SOAR to 8.7.0. Cisco describes this as a software hardening release that addresses multiple internally discovered vulnerabilities, including CVE-2026-76529.
2. Before the update is applied, restrict network access to Splunk SOAR so that it is reachable only from trusted management networks or through a VPN. The CVSS vector shows no privileges or user interaction are required and attack complexity is low, so network reach is the main pre-patch exposure.
3. If you cannot update immediately, review Splunk's advisory for any platform-specific steps, and confirm the version on every Splunk SOAR instance in your inventory.

How to detect it

The CVE record does not provide vendor-specific indicators of compromise. Because the vector shows network reach with no credentials or user interaction, the practical detection step is to confirm whether any Splunk SOAR instance is reachable from untrusted networks. If exposure management already identifies open management or orchestration interfaces, start there.

Beyond the patch

This is a critical, unauthenticated network flaw in a platform that security teams rely on, so exposed instances turn a patchable defect into a wider incident. Our Virtual CISO Services (vCISO) can help you map which management and orchestration interfaces are reachable, and close unnecessary exposure before an upgrade is completed. Keeping track of vendors that supply security tooling, and verifying how quickly their fixes are adopted, is part of Supply Chain Defense & Third-Party Risk.