CVE-2026-76369 in SOAR
Summary
by MITRE • 08/19/2026
In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the intended Automation Broker log directory. The vulnerability is possible because Automation Broker log uploads accept crafted filename input before writing log files. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) and About Splunk SOAR Automation Broker (https://help.splunk.com/en/splunk-soar/splunk-automation-broker/about-splunk-soar-automation-broker/about-splunk-soar-automation-broker) in the Splunk documentation.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in Splunk SOAR versions prior to 8.6.0 represents a significant path traversal and arbitrary file write flaw within the Automation Broker component. This security defect allows an authenticated user possessing the OnPrem Broker role to bypass intended directory restrictions, enabling them to write files outside of the designated log upload directory. The root cause lies in insufficient input validation regarding filename parameters accepted by the Automation Broker during its log processing routine. When a user submits crafted filenames containing path traversal sequences or absolute paths, the system fails to sanitize these inputs before writing the associated data. This lack of strict canonicalization allows an attacker to manipulate the file system structure, effectively escaping the sandboxed environment intended for automated broker logs and gaining write access to arbitrary locations on the underlying operating system where Splunk SOAR is deployed.
From a technical perspective, this flaw aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The vulnerability exploits the trust placed in authenticated users who are granted specific operational roles within the platform. While the OnPrem Broker role is designed for legitimate administrative and automation tasks, it inadvertently provides sufficient privileges to interact with file system operations without adequate boundary checks. By injecting maliciously formatted filenames, an attacker can overwrite critical configuration files, inject web shells into accessible directories, or corrupt other sensitive data stored outside the log directory. This capability transforms a simple logging mechanism into a potent vector for further exploitation, potentially leading to remote code execution if the written file is subsequently executed by another process with higher privileges.
The operational impact of this vulnerability extends beyond mere unauthorized access. An attacker who successfully exploits this flaw can compromise the integrity and availability of the Splunk SOAR environment. By overwriting system files or injecting malicious scripts, they may disrupt security operations center workflows, steal sensitive data processed through the platform, or establish a persistent foothold for lateral movement within the network. Given that Splunk SOAR often serves as a central hub for incident response and threat intelligence aggregation, compromising its infrastructure can have cascading effects on an organization's overall cybersecurity posture. The ability to write arbitrary files also facilitates privilege escalation scenarios if combined with other local vulnerabilities or misconfigurations present in the host environment.
Mitigation strategies primarily involve upgrading to Splunk SOAR version 8.6.0 or later, where this issue has been addressed through enhanced input validation and stricter directory confinement for log uploads. Organizations should immediately verify their current software versions against the vendor's security advisories. In addition to patching, administrators should review role-based access controls to ensure that only essential personnel hold the OnPrem Broker role, adhering to the principle of least privilege. Monitoring logs for unusual file creation patterns or unexpected directory changes can also aid in detecting potential exploitation attempts before significant damage occurs. Furthermore, implementing strict network segmentation and regular vulnerability assessments will help reduce the attack surface associated with such administrative interfaces.
This incident underscores the importance of rigorous input sanitization in components that handle user-supplied data for system operations. The ATT&CK framework categorizes this type of behavior under T1530: Data from Cloud Storage Object or potentially T1222: File and Directory Permissions Modification, depending on how the written files are utilized post-exploitation. Security teams should treat such vulnerabilities as critical due to their direct impact on system integrity and the potential for widespread compromise within enterprise security platforms. Continuous monitoring of vendor updates and proactive application of patches remain the most effective defense against these types of logic flaws in managed services like Splunk SOAR.