Splunk SOAR file access vulnerability allows low-privileged attackers to compromise the platform (CVE-2026-76531)

What happened

Cisco identified this issue during an internal security review and describes it as a group of vulnerabilities in Splunk SOAR related to files or directories accessible to external parties (CWE-552). The affected functionality is reachable over the network. An attacker needs a low-privileged account on the SOAR platform, and no user interaction is required.

The CVSS vector records a critical severity with score 9.9: low attack complexity, changed scope, and high impact on confidentiality, integrity and availability. In plain terms, a low-privileged user who can reach the SOAR interface may be able to access files or directories that should be restricted, and that access can affect the wider deployment. Cisco has not reported exploitation of this flaw, and the CVE record does not note public disclosure.

Who is affected

Splunk SOAR versions before 8.7.0 are affected. Cisco lists no other affected products or version lines, and the only fixed release listed is Splunk SOAR 8.7.0. If your organisation runs Splunk SOAR, check the deployed version against that fixed release.

What to do now

Patch first. The fixed release is Splunk SOAR 8.7.0.

1. Upgrade all Splunk SOAR deployments to version 8.7.0.
2. If the upgrade must be delayed, restrict network access to the SOAR application and management interfaces so only trusted administrative networks can reach them.
3. Review low-privilege accounts on the SOAR platform and remove or disable unused accounts; a low-privilege account is enough to attempt exploitation.

Cisco has not published a workaround.

How to detect it

Cisco has not published indicators of compromise for this issue. As a precaution, review Splunk SOAR audit or access logs for unusual file or directory access by low-privilege users that cannot be explained by normal automation or administrative activity. Focus first on instances that were reachable from the internet or from less-trusted network segments.

Beyond the patch

Supplier patch cycles set your exposure window: the time between a vendor's fixed release and your upgrade is risk you carry. Spirity's Supply Chain Defense & Third-Party Risk service tracks the software vendors you run, including version spread and patch latency, so a release like Splunk SOAR 8.7.0 becomes a measured risk rather than a surprise.