https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-76370.htmlhttps://patchthecve.com/cve/CVE-2026-76370.htmlFri, 21 Aug 2026 14:46:44 +0000MEDIUM 4.3: In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the Representational State Transfer (REST) API to view the names and identifiers of tenants that fall outside the role scope for that user. The vulnerability is possible because Splunk SOAR does not enhttps://patchthecve.com/cve/CVE-2026-76369.htmlhttps://patchthecve.com/cve/CVE-2026-76369.htmlFri, 21 Aug 2026 14:46:18 +0000LOW 2.7: In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the intended Automation Broker log directory. The vulnerability is possible because Automation Broker log uploads accept crafted filename input before writing log files. For more information see Mahttps://patchthecve.com/cve/CVE-2026-76368.htmlhttps://patchthecve.com/cve/CVE-2026-76368.htmlFri, 21 Aug 2026 14:46:11 +0000LOW 2.7: In Splunk SOAR versions below 8.6.0, a user who holds a role that contains the playbooks:view permission could view metadata about a playbook repository that they are not authorized to view. The vulnerability is possible because Playbook History does not check repository permissions before returninghttps://patchthecve.com/cve/CVE-2026-76367.htmlhttps://patchthecve.com/cve/CVE-2026-76367.htmlWed, 26 Aug 2026 16:16:41 +0000MEDIUM 4.0: In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the browser of another user when that user opens the note. The stored Cross-Site Scripting (XSS) vulnerability is possible because Splunk SOAR can treat exishttps://patchthecve.com/cve/CVE-2026-76366.htmlhttps://patchthecve.com/cve/CVE-2026-76366.htmlFri, 21 Aug 2026 14:54:44 +0000MEDIUM 6.5: In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer (REST) API filtering on playbook runs to recover session tokens that compromise all data available to the affected user. The information disclosure is possible because Splunk SOAR dhttps://patchthecve.com/cve/CVE-2026-76365.htmlhttps://patchthecve.com/cve/CVE-2026-76365.htmlFri, 21 Aug 2026 14:54:39 +0000MEDIUM 6.5: In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database through custom list retrieval in a playbook, allowing for create, read, update, and delete operations on alhttps://patchthecve.com/cve/CVE-2026-76364.htmlhttps://patchthecve.com/cve/CVE-2026-76364.htmlFri, 21 Aug 2026 14:47:22 +0000MEDIUM 6.5: In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database through custom function results, allowing for reading all relevant data stored in the Splunk SOAR database https://patchthecve.com/cve/CVE-2026-76363.htmlhttps://patchthecve.com/cve/CVE-2026-76363.htmlFri, 21 Aug 2026 14:51:31 +0000MEDIUM 6.5: In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database and create, read, update, or delete all data in the database. The vulnerability is possible because Splunk SOAR playboohttps://patchthecve.com/cve/CVE-2026-76362.htmlhttps://patchthecve.com/cve/CVE-2026-76362.htmlFri, 21 Aug 2026 14:55:01 +0000HIGH 7.4: In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer (REST) server could access or modify all relevant data exchanged through that credential manager. The vulnerability is phttps://patchthecve.com/cve/CVE-2026-76361.htmlhttps://patchthecve.com/cve/CVE-2026-76361.htmlFri, 21 Aug 2026 14:45:28 +0000LOW 2.7: In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../check_connectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The Serhttps://patchthecve.com/cve/CVE-2026-76360.htmlhttps://patchthecve.com/cve/CVE-2026-76360.htmlFri, 21 Aug 2026 14:45:01 +0000MEDIUM 4.3: In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health endpoint to gather system and cluster telemetry that should be restricted to administrative or support users. The vulnerability is a missing authorization check, where the endpoint does not vehttps://patchthecve.com/cve/CVE-2026-76359.htmlhttps://patchthecve.com/cve/CVE-2026-76359.htmlFri, 21 Aug 2026 14:44:54 +0000MEDIUM 6.5: In Splunk SOAR versions below 8.6.0, a user who holds the Administrator role could use path traversal in the Universal Forwarder installer's archive extraction to write files outside the intended installation directory. The vulnerability is possible because the Universal Forwarder credentials-packaghttps://patchthecve.com/cve/CVE-2026-76358.htmlhttps://patchthecve.com/cve/CVE-2026-76358.htmlFri, 21 Aug 2026 14:44:42 +0000MEDIUM 6.5: In Splunk SOAR versions below 8.6.0, a user with app-install privileges could use path traversal during app installation to write files outside the intended temporary directory. The vulnerability is a path traversal in the archive extraction routine, which does not validate that extracted file pathshttps://patchthecve.com/cve/CVE-2026-76357.htmlhttps://patchthecve.com/cve/CVE-2026-76357.htmlFri, 21 Aug 2026 14:44:06 +0000HIGH 7.6: In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the Representational State Transfer (REST) API and execute arbitrary code. The vulnerability is possible because the REST API does not require an assigned role for the request and doehttps://patchthecve.com/cve/CVE-2026-76356.htmlhttps://patchthecve.com/cve/CVE-2026-76356.htmlThu, 27 Aug 2026 17:20:16 +0000HIGH 8.1: In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to an Automation Broker notification endpoint and execute arbitrary code on the Splunk SOAR host. The vulnerability is possible because the Splunk SOAR Automation Broker trusts a clien