Splunk SOAR: Improper protection of alternate path
Summary
Splunk SOAR versions below 8.7.0 contain a flaw classified as CWE-424 (Improper Protection of Alternate Path). It is one of several internally found vulnerabilities fixed in Splunk's security hardening release. The advisory does not describe the attack conditions, so it is unknown whether exploitation requires authentication or network access. Splunk's advisory lists 7.5 as the highest CVSS score for this CVE, while the CVE record shows 9.8, which is not confirmed by the vendor.
Affected
- Splunk SOAR below 8.7.0
- Minor versions within 8.6.x are not described separately by the vendor.
Fixed in
- Upgrade to Splunk SOAR 8.7.0 or higher.
Workaround
Unknown. The vendor only recommends upgrading. Restricting network access to the SOAR instance until the upgrade is a general mitigation, not a vendor workaround.
Exploitation
- Not listed in CISA's Known Exploited Vulnerabilities catalog.
- The vendor advisory does not mention exploitation.
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
- No public proof of concept known.
Our recommendation
- Identify all Splunk SOAR instances and their versions.
- Upgrade every instance below 8.7.0 to 8.7.0 or higher.
- Until upgraded, restrict network access to the SOAR instance, as it is normally deployed behind the SOC network.
- Check NVD for the official CVSS score and vector once analysis is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Splunk advisory SVD-2026-1011 advisory.splunk.com
- CVE record summary (OpenCVE) app.opencve.io
- Third-party listing (ThreatInt) cve.threatint.com
- Third-party listing (OffSeq Radar) radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:22.
Original description (NVD)
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76529 are related to improper protection of alternate path and are grouped under the Common Weakness Enumeration (CWE) CWE-424.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.