CVE-2026-76371 in FireAMP
Summary
by MITRE • 08/19/2026
In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to file lists. The vulnerability is possible because the FireAMP connector action manifest classifies the add listitem action as read-only even though the action updates file lists. For more information see Manage settings for a playbook in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/manage-settings-for-a-playbook-in-splunk-soar-cloud) in the Splunk documentation.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in FireAMP versions prior to 2.1.15 represents a critical authorization bypass within the Splunk SOAR automation framework, specifically affecting users with roles capable of editing, creating, or executing playbooks. The core technical flaw lies in a discrepancy between the declared capabilities of an action and its actual operational behavior during execution in Safe Mode. Specifically, the add listitem action within the FireAMP connector is incorrectly classified as read-only in the action manifest. This misclassification leads to a failure in enforcing access control policies that are designed to prevent modifications when playbooks operate under restricted permissions or safe mode constraints. Consequently, an attacker with legitimate but limited privileges can exploit this inconsistency to perform write operations on file lists, effectively bypassing the intended security controls of the platform.
From a technical perspective, the issue stems from how the connector's manifest defines action parameters and their associated side effects. In Splunk SOAR, Safe Mode is designed to restrict actions that could alter system state or data integrity, ensuring that automated workflows do not inadvertently cause harmful changes during testing or restricted operations. By marking an action as read-only while it simultaneously possesses the capability to modify file lists, the system fails to validate whether the current execution context permits such modifications. This logic error allows the add listitem function to execute successfully despite being flagged for restriction, thereby undermining the integrity of the access control model. The vulnerability highlights a gap in how parameter definitions are mapped to runtime permission checks within the connector architecture.
The operational impact of this flaw is significant for organizations relying on Splunk SOAR and FireAMP for security orchestration and automated response. Unauthorized changes to file lists can lead to several adverse outcomes, including the addition of malicious files to allowlists or the removal of critical entries from blocklists. This manipulation could result in false negatives where malware evades detection because it has been added to a trusted list, or conversely, cause service disruptions if legitimate files are incorrectly removed. Furthermore, this vulnerability enables privilege escalation within the SOAR environment, as users with lower-level permissions can achieve effects reserved for administrators or higher-privileged roles. This compromises the principle of least privilege and erodes trust in the automated security workflows managed by the platform.
To mitigate this risk, organizations must immediately upgrade FireAMP to version 2.1.15 or later, where the action manifest has been corrected to accurately reflect the write capabilities of the add listitem function. This ensures that Safe Mode restrictions are properly enforced and that unauthorized modifications cannot occur through this specific vector. Additionally, administrators should review existing playbooks for any reliance on actions with mismatched permission definitions and validate their configurations against current best practices. Regular audits of connector manifests and action permissions can help identify similar discrepancies before they are exploited.
This vulnerability aligns with CWE-269, which addresses Improper Privilege Management, as it involves a user obtaining privileges or performing operations that exceed their assigned role capabilities. It also relates to CWE-732, concerning Incorrect Permission Assignment for Critical Resource, given the misclassification of an action's write permissions in its metadata. In terms of offensive security frameworks, this flaw facilitates techniques associated with ATT&CK T1098, specifically SSH Exploitation or Account Manipulation variants where attackers exploit configuration errors to gain unauthorized access or modify system configurations. Addressing these issues requires both immediate patching and a broader review of how automation tools enforce permission boundaries during execution.