CVE-2026-76372 in Nmap Scanner
Summary
by MITRE • 08/19/2026
In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system through Nmap Scripting Engine scripts. The vulnerability is possible because the Nmap Scanner connector action manifest classifies the scan network action as read-only even though the action accepts script parameters that can perform write operations. For more information see Manage settings for a playbook in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/manage-settings-for-a-playbook-in-splunk-soar-cloud) in the Splunk documentation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified involves a critical authorization bypass within Nmap Scanner versions prior to 3.0.15 when integrated with Splunk SOAR, specifically affecting users who possess roles capable of editing, creating, or executing playbooks. The core technical flaw stems from a misconfiguration in the connector action manifest where the scan network action is incorrectly classified as read-only. This classification implies that the operation should not modify any state on target systems, thereby restricting user actions to passive data gathering. However, despite this restrictive labeling, the underlying implementation of the Nmap Scanner accepts script parameters that are capable of executing write operations and modifying system states through the Nmap Scripting Engine.
This discrepancy between the declared capability in the manifest and the actual functional behavior creates a significant security gap. When an authorized user runs such a playbook in Safe Mode, they expect the environment to enforce strict boundaries preventing destructive actions. Instead, because the action is marked as read-only but executes scripts with write capabilities, users can inadvertently or maliciously perform command execution on target systems. The Nmap Scripting Engine allows for complex interactions including file manipulation, service interaction, and remote code execution depending on the specific script invoked. Consequently, what appears to be a safe, non-intrusive scan action becomes a vector for unauthorized modifications and potential compromise of the targeted infrastructure.
The operational impact of this vulnerability is severe as it undermines the integrity controls provided by Safe Mode playbooks in Splunk SOAR. Organizations rely on these modes to prevent accidental changes during testing or sensitive operations. By exploiting this flaw, an attacker with legitimate playbook privileges can bypass intended restrictions and execute arbitrary commands against networked assets. This effectively elevates the risk from a simple information disclosure scenario to one involving full system compromise via remote code execution. The ability to run scripts that modify files or configurations means that attackers could establish persistence, escalate privileges further by altering local security settings, or disrupt services on the target host.
From an industry standard perspective, this vulnerability aligns with CWE-250, which denotes Execution with Unnecessary Privileges, as the action performs write operations under a guise of read-only access. It also relates to CWE-862, Missing Authorization, because the system fails to enforce the intended restriction based on the declared role and mode context. In terms of MITRE ATT&CK techniques, this scenario maps directly to T1059 Command and Scripting Interpreter, specifically through mechanisms like PowerShell or other scripting engines invoked by Nmap scripts. It also touches upon T1486 Data Encrypted for Impact if the executed scripts are used to deploy ransomware or encrypt data, although the primary immediate risk is unauthorized command execution.
To mitigate this vulnerability, organizations must immediately upgrade the Nmap Scanner connector in Splunk SOAR to version 3.0.15 or later where this manifest classification error has been corrected. Until an update is applied, administrators should restrict playbook creation and editing privileges to a minimal set of trusted users who fully understand the implications of using the Nmap Scripting Engine. Additionally, it is advisable to audit existing playbooks for any instances of the scan network action running in Safe Mode and verify that no scripts with write capabilities are being invoked through this interface. Implementing strict input validation on script parameters can also help reduce the risk if upgrading is not immediately feasible, although patching remains the definitive solution.