SOAR (8.5.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/soar-8.5.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 19 Aug 2026 22:43:10 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgArbitrary Code Execution in Splunk SOAR via Path Traversalhttps://feed.craftedsignal.io/briefs/2026-08-splunk-soar-rce/Wed, 19 Aug 2026 22:43:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-splunk-soar-rce/Splunk SOAR versions prior to 8.6.0 are vulnerable to authenticated remote code execution due to improper path validation and insufficient role-based access control on the REST API.Splunk SOAR versions below 8.6.0 contain a critical vulnerability identified as CVE-2026-76357, which allows authenticated users without assigned roles to achieve arbitrary code execution. The vulnerability is rooted in the REST API's failure to enforce role-based access controls for specific requests and a lack of input validation regarding file path parameters. An attacker can submit a crafted file path to the API, bypassing directory restrictions to execute arbitrary code on the underlying host. This vulnerability poses a significant risk to organizational environments relying on Splunk SOAR for security orchestration and response, as it enables unauthorized system-level operations by low-privileged authenticated accounts. Defenders should prioritize patching all Splunk SOAR instances to version 8.6.0 or higher.

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary code with the privileges of the Splunk SOAR service account. This could lead to full compromise of the SOAR platform, lateral movement within the network, and the potential exfiltration or manipulation of sensitive security orchestration data. Organizations using Splunk SOAR for automated incident response are at high risk if default or low-privileged accounts are compromised.

Recommendation

  • Upgrade Splunk SOAR (On-premises) to version 8.6.0 or higher immediately.
  • Review user accounts and role assignments within the Splunk SOAR platform to ensure the principle of least privilege is applied, specifically limiting access to REST API endpoints.
  • Audit access logs for the SOAR REST API to identify anomalous requests involving directory traversal patterns (e.g., ../, .., or absolute file paths) originating from unprivileged or newly created service accounts.
]]>highadvisoryvulnerabilityrcesplunk