Splunk SOAR: Improper control of a resource through its lifetime

Summary

Splunk SOAR versions below 8.7.0 contain a flaw in which a resource is not properly controlled over its lifetime (CWE-664). The vendor advisory SVD-2026-1011 does not describe the individual flaw. Splunk scores this CVE 8.8, and the CISA SSVC assessment rates it as automatable with total technical impact. The 9.8 score in the supplied data is not confirmed by a source, and it is unknown whether the flaw is reachable without authentication.

Affected

• Splunk SOAR versions below 8.7.0

Fixed in

• Upgrade to Splunk SOAR 8.7.0 or higher

Workaround

Unknown. The vendor lists no workaround; the upgrade is the only remedy named.

Exploitation

• Not listed as exploited in the wild; not in the CISA KEV list according to OpenCVE.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• No public proof of concept found.

Our recommendation

• If you run Splunk SOAR below 8.7.0, upgrade to 8.7.0 or higher as a patch priority.
• Until the upgrade, restrict network access to the SOAR management interface.
• Ask Splunk support whether the flaw is reachable without authentication in your deployment.
• If you do not run Splunk SOAR, no action is needed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Splunk advisory SVD-2026-1011 advisory.splunk.com
• OpenCVE CVE-2026-76408 app.opencve.io
• ThreatINT CVE-2026-76408 cve.threatint.com
• Strix CVE-2026-76408 www.strix.ai
• VulDB CVE-2026-76408 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:22.