CVE-2026-76373 in AD LDAP App
Summary
by MITRE • 08/20/2026
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could inject crafted input into an Active Directory query to enumerate Active Directory objects, including accounts, groups, and organizational units, read sensitive attributes from arbitrary directory objects, and redirect account modification actions to unintended objects. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in versions of the AD LDAP app for Splunk SOAR prior to version 2.3.8 represents a critical security flaw rooted in insufficient input validation and improper handling of user-supplied data within Active Directory query operations. This issue primarily affects users who possess roles with permissions to execute actions, allowing them to manipulate the underlying Lightweight Directory Access Protocol queries used by the application. By injecting crafted input into these queries, an authenticated attacker can bypass intended access controls and interact directly with the directory service in ways that were not anticipated by the software developers. The core technical flaw lies in the lack of sanitization or strict filtering mechanisms for parameters passed to LDAP search filters, which enables injection attacks similar to SQL injection but targeting directory services instead.
The operational impact of this vulnerability is severe due to the sensitive nature of Active Directory data and its central role in enterprise identity management. An attacker leveraging this flaw can perform extensive enumeration of Active Directory objects, including user accounts, security groups, and organizational units. This reconnaissance phase provides a detailed map of the network's identity infrastructure, facilitating further attacks such as privilege escalation or lateral movement. Furthermore, the vulnerability allows for the reading of sensitive attributes from arbitrary directory objects. Depending on the specific configuration and permissions granted to the compromised account, this could expose personally identifiable information, password hashes if improperly configured, or other confidential metadata stored within the LDAP database.
Beyond data exfiltration, the flaw enables a more destructive capability: redirecting account modification actions to unintended objects. This means that an attacker can manipulate update operations so that changes intended for one user or group are applied to another. For instance, modifying email addresses, phone numbers, or even password reset tokens could be directed at high-privilege accounts rather than the target specified by the legitimate action invocation. This capability undermines the integrity of identity management processes and can lead to account takeovers, unauthorized access grants, or denial of service conditions if critical attributes are corrupted. The ability to redirect modifications effectively allows an attacker to escalate privileges or disrupt business operations without needing direct administrative credentials for those specific targets.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and specifically LDAP injection variants under CWE-90 SQL/LDAP Injection when applied to directory services. It also relates to CWE-285 Improper Authorization as the attacker exploits existing permissions to perform actions beyond their intended scope through manipulation rather than direct privilege escalation. In terms of MITRE ATT&CK, this behavior maps to T1087 Account Discovery and T1098 Manipulated Credentials or Access Token Modification, depending on whether the focus is on enumeration or the redirection of modifications. The exploitation requires authentication, placing it within the context of insider threats or compromised service accounts rather than remote unauthenticated attacks.
Mitigation strategies must prioritize immediate patching to version 2.3.8 or later where these input validation issues have been addressed by Splunk. In environments where upgrading is not immediately feasible, administrators should implement strict network segmentation and firewall rules to restrict access to the AD LDAP app components from only trusted sources. Additionally, enforcing least-privilege principles for roles that can run actions in Splunk SOAR reduces the attack surface; users requiring minimal permissions should be assigned restricted roles that do not allow execution of high-risk directory operations. Monitoring logs for anomalous LDAP query patterns or unexpected modifications to Active Directory objects can also aid in early detection and response to exploitation attempts. Regular audits of role assignments and action permissions within Splunk SOAR are essential to ensure that only authorized personnel have the capability to interact with sensitive identity management functions.