Splunk FireAMP up to 2.1.14 Add Listitem Action improper authorization

Summaryinfo

A vulnerability identified as problematic has been detected in Splunk FireAMP up to 2.1.14. The impacted element is an unknown function of the component Add Listitem Action. The manipulation leads to improper authorization. This vulnerability is documented as CVE-2026-76371. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Splunk FireAMP up to 2.1.14 and classified as problematic. This issue affects some unknown functionality of the component Add Listitem Action. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is integrity. The summary by CVE is:

In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to file lists. The vulnerability is possible because the FireAMP connector action manifest classifies the add listitem action as read-only even though the action updates file lists. For more information see Manage settings for a playbook in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/manage-settings-for-a-playbook-in-splunk-soar-cloud) in the Splunk documentation.

The advisory is shared at advisory.splunk.com. The identification of this vulnerability is CVE-2026-76371 since 08/19/2026. The exploitation is known to be easy. The attack may be initiated remotely. The exploitation needs additional levels of successful authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

Upgrading to version 2.1.15 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Log Management Software

Vendor

• Splunk

Name

• FireAMP

Version

• 2.1.0
• 2.1.1
• 2.1.2
• 2.1.3
• 2.1.4
• 2.1.5
• 2.1.6
• 2.1.7
• 2.1.8
• 2.1.9
• 2.1.10
• 2.1.11
• 2.1.12
• 2.1.13
• 2.1.14

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion