Splunk SOAR: Improper Neutralization (CWE-707)
Summary
Splunk SOAR versions below 8.7.0 are affected by a vulnerability grouped under CWE-707 (Improper Neutralization) in Cisco's CVE record and Splunk advisory SVD-2026-1011. The individual flaws, affected components and attack details are not described, so the exact impact is unknown. The CVSS 8.8 vector indicates network access with a low-privileged account and no user interaction, with high impact on confidentiality, integrity and availability. The 9.9 score in the advisory header belongs to a different CVE in the same advisory.
Affected
- Splunk SOAR, base version 8.7, all versions below 8.7.0
Fixed in
- Upgrade to Splunk SOAR 8.7.0 or higher (per SVD-2026-1011)
Workaround
Unknown. No workaround is documented; whether configuration changes reduce exposure is unknown.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
- Not listed in CISA KEV
- Advisory does not mention exploitation
- No public proof-of-concept known
Our recommendation
- Identify all Splunk SOAR instances and confirm their versions
- Plan the upgrade to 8.7.0 or higher as soon as possible
- Make sure SOAR is not reachable from the internet until patched
- Restrict access to the SOAR web interface and API to authorised users and networks
- Monitor SOAR logs for unusual activity
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Splunk Advisory SVD-2026-1011 advisory.splunk.com
- OpenCVE: CVE-2026-76526 app.opencve.io
- CVE Threat Intelligence: CVE-2026-76526 cve.threatint.com
- OffSeq Radar: CVE-2026-76526 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:02.
Original description (NVD)
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76526 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.