Splunk SOAR: Improper check or handling of exceptional conditions

Summary

Splunk SOAR versions below 8.7.0 contain an improper check or handling of exceptional conditions (CWE-703). It was fixed in a bundled security hardening release. Splunk's advisory does not describe the specific flaw, the attack vector or the required privileges. Splunk rates this CVE at 5.5; the CVSS 9.8 in the supplied data could not be verified, and CISA SSVC data lists the flaw as automatable with total technical impact.

Affected

• Splunk SOAR below 8.7.0 (base version 8.7)

Fixed in

• Upgrade to Splunk SOAR 8.7.0 or higher

Workaround

Unknown.

Exploitation

• Not in CISA's Known Exploited Vulnerabilities (KEV) list
• CISA SSVC (via ADP): exploitation none, automatable yes, technical impact total
• No public proof of concept or in-the-wild exploitation found

Our recommendation

• If Splunk SOAR is not used, no action is needed.
• If SOAR 8.6 or earlier is running and reachable from untrusted networks, plan the upgrade to 8.7.0 or higher as soon as possible.
• Check whether the SOAR web interface and API are exposed to the internet and whether attackers need credentials.
• Upgrade covers the other CVEs in the same Splunk SOAR hardening release.
• Monitor SOAR logs for unusual access and treat the CVSS 9.8 figure as unverified until NVD completes its analysis.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Splunk advisory SVD-2026-1011 advisory.splunk.com
• VulDB CVE-2026-76527 vuldb.com
• OpenCVE CVE-2026-76527 (SSVC, KEV) app.opencve.io
• GitHub Advisory GHSA-crq7-hg23-h2c6 github.com
• Strix CVE-2026-76527 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:03.