Splunk SOAR: Files or directories accessible to external parties

Summary

Splunk SOAR versions below 8.7.0 contain a flaw classified as CWE-552 (Files or Directories Accessible to External Parties). The vendor advisory does not describe the underlying flaw or affected components. The CVSS vector indicates that an attacker with low privileges on the network could compromise confidentiality, integrity and availability with a scope change.

Affected

• Splunk SOAR versions below 8.7.0 (advisory SVD-2026-1011)
• Note: the record lists the vendor as Cisco as CNA; the product is Splunk SOAR

Fixed in

• Splunk SOAR 8.7.0 or higher

Workaround

• Unknown. No workaround is documented; the vendor's only stated remedy is the upgrade.

Exploitation

• Not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept found; no exploitation reported in the sources reviewed.

Our recommendation

• Identify all Splunk SOAR instances and their versions.
• Upgrade to Splunk SOAR 8.7.0 or higher as soon as possible.
• Restrict SOAR access to trusted networks and review low-privilege accounts.
• Monitor SOAR logs for unusual access and check the vendor advisory for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Splunk advisory SVD-2026-1011 advisory.splunk.com
• OpenCVE record (KEV and SSVC data) app.opencve.io
• VulDB CVE-2026-76531 vuldb.com
• Vulners PT-2026-120875 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:57.