Splunk SOAR - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/splunk-soar/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 19 Aug 2026 22:43:03 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnauthenticated Remote Code Execution in Splunk SOAR via Automation Brokerhttps://feed.craftedsignal.io/briefs/2026-08-splunk-soar-rce/Wed, 19 Aug 2026 22:43:03 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-splunk-soar-rce/Splunk SOAR versions prior to 8.6.0 are vulnerable to remote code execution because the Automation Broker fails to validate client-supplied source IP headers, allowing unauthenticated attackers to spoof local requests.Splunk SOAR versions below 8.6.0 contain a critical vulnerability in the Automation Broker notification endpoint. The vulnerability arises because the Automation Broker improperly trusts client-supplied source IP address headers to verify the origin of a request. An unauthenticated attacker can craft an HTTP request that spoofs the source IP to appear as though it originates from the local host, bypassing intended access controls. Successful exploitation enables the execution of arbitrary code on the underlying host, which can lead to full system compromise, data exfiltration, and service disruption. Defenders should prioritize patching Splunk SOAR instances to version 8.6.0 or later to mitigate this risk.

Impact

Successful exploitation of CVE-2026-76356 allows an unauthenticated, remote attacker to execute arbitrary code on the Splunk SOAR host. This results in complete compromise of the SOAR platform, potential access to highly sensitive security data stored within the SOAR environment, and the ability to pivot to other integrated security tools or managed internal systems.

Recommendation

  • Upgrade all Splunk SOAR instances to version 8.6.0 or higher immediately.
  • Until patching is possible, restrict network access to the Automation Broker notification endpoint to only authorized, trusted IP ranges at the network perimeter or application firewall level.
  • Review web server access logs for requests to the Automation Broker endpoint originating from unexpected or external IP addresses that attempt to manipulate header fields.
]]>highadvisoryrcevulnerabilitysplunk