CVE-2026-76356
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to an Automation Broker notification endpoint and execute arbitrary code on the Splunk SOAR host. The vulnerability exists because the Splunk SOAR Automation Broker trusts a client-supplied source IP address header as proof that the request originates from the local system. Successful exploitation can expose all relevant data, affect system integrity, and disrupt service availability.
Risk Assessment
The risk includes remote code execution by an unauthenticated attacker, potentially leading to full system compromise, data confidentiality breach, and service disruption.
Recommendation
It is recommended to upgrade Splunk SOAR to version 8.6.0 or later and configure Automation Broker to not trust client-supplied IP headers.
Original NVD description (English source)
In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to an Automation Broker notification endpoint and execute arbitrary code on the Splunk SOAR host. The vulnerability is possible because the Splunk SOAR Automation Broker trusts a client-supplied source IP address header as proof that the request originates from the local system. Successful exploitation can expose all relevant data, affect system integrity, and disrupt service availability. For more information see About Splunk SOAR Automation Broker (https://help.splunk.com/en/splunk-soar/splunk-automation-broker/about-splunk-soar-automation-broker/about-splunk-soar-automation-broker) in the Splunk documentation.