CVE-2026-76303

In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could store attacker-controlled content that Splunk SOAR displays in app documentation by installing an app. If another user who holds a role with permission to view apps opens the app documentation, Splunk SOAR could run that content in the browser of the user who opened the app documentation. With this access, the first user could access data and make changes that the user who opened the app documentation could make. The vulnerability is possible because Splunk SOAR does not sanitize app documentation content before it displays that content. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user that holds a role with the install_apps capability should not be able to exploit the vulnerability at will. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/7.1.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Add and configure apps and assets to provide actions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.6.0/manage-your-splunk-soar-on-premises-apps-and-assets/add-and-configure-apps-and-assets-to-provide-actions-in-splunk-soar-on-premises) in the Splunk documentation.

• CWE-79

• https://advisory.splunk.com/advisories/SVD-2026-1010

Published

Oct 21, 2026

Last Modified

Oct 21, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76298In Splunk Enterprise versions below 10.4.4 and 10.2.8, a use…8.8
• CVE-2026-76299As part of Cisco's ongoing commitment to proactive security …
• CVE-2026-7630A vulnerability has been found in innocommerce InnoShop up t…7.3
• CVE-2026-76300As part of Cisco's ongoing commitment to proactive security …
• CVE-2026-76301As part of Cisco's ongoing commitment to proactive security …
• CVE-2026-76302As part of Cisco's ongoing commitment to proactive security …
• CVE-2026-76304In Splunk SOAR versions below 8.7.0, an authenticated user w…4.3
• CVE-2026-76305In Splunk SOAR versions below 8.7.0, an authenticated user w…6.5
• CVE-2026-76306In Splunk SOAR versions below 8.7.0, a user that has the "Ob…7.5
• CVE-2026-76307In Splunk SOAR versions below 8.7.0, a user that holds a rol…7.2
• CVE-2026-76308In Splunk SOAR versions below 8.7.0, an authenticated user c…6.5
• CVE-2026-76309In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, …4.3