soar vulnerabilities and fixes

Recent CVEs affecting soar, with upgrade or downgrade steps. 15 tracked.

soar has 15 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 15. Most recent: 2026-08-19. Highest priority: CVE-2026-76356 (score 46/100).

• CVE-2026-76356 HIGH 8.1 UPGRADE In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted re
• CVE-2026-76367 MEDIUM 4.0 UPGRADE In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store Ja
• CVE-2026-76362 HIGH 7.4 UPGRADE In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between
• CVE-2026-76366 MEDIUM 6.5 UPGRADE In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State
• CVE-2026-76365 MEDIUM 6.5 UPGRADE In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arb
• CVE-2026-76363 MEDIUM 6.5 UPGRADE In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" role could run arbitrary Struc
• CVE-2026-76364 MEDIUM 6.5 UPGRADE In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arb
• CVE-2026-76370 MEDIUM 4.3 UPGRADE In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the Represe
• CVE-2026-76369 LOW 2.7 UPGRADE In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the int
• CVE-2026-76368 LOW 2.7 UPGRADE In Splunk SOAR versions below 8.6.0, a user who holds a role that contains the playbooks:view permission could
• CVE-2026-76361 LOW 2.7 UPGRADE In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connecti
• CVE-2026-76360 MEDIUM 4.3 UPGRADE In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health en
• CVE-2026-76359 MEDIUM 6.5 UPGRADE In Splunk SOAR versions below 8.6.0, a user who holds the Administrator role could use path traversal in the U
• CVE-2026-76358 MEDIUM 6.5 UPGRADE In Splunk SOAR versions below 8.6.0, a user with app-install privileges could use path traversal during app in
• CVE-2026-76357 HIGH 7.6 UPGRADE In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file p

FAQ

How do I fix soar vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is soar being exploited right now?

None of the tracked soar CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which soar CVE should I patch first?

CVE-2026-76356 currently ranks highest (46/100): In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted re.

RSS feed for soar · ← Back to latest CVEs