CVE-2026-76371
Last modified
CVE-2026-76371 is a low-severity vulnerability rated 2.7/10 on the CVSS scale. In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to file lists. The vulnerability is possible because the FireAMP connector action manifest classifies the add listitem action as read-only even though the action updates file lists. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to file lists. The vulnerability is possible because the FireAMP connector action manifest classifies the add listitem action as read-only even though the action updates file lists. For more information see Manage settings for a playbook in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/manage-settings-for-a-playbook-in-splunk-soar-cloud) in the Splunk documentation.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Splunk | FireAMP | >= 2.1, < 2.1.15 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-76371?
How severe is CVE-2026-76371?
How do I fix CVE-2026-76371?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-76366In Splunk SOAR versions below 8.6.0, a user with a valid Spl…6.5
- CVE-2026-76367In Splunk SOAR versions below 8.6.0, a user who holds the "I…4
- CVE-2026-76368In Splunk SOAR versions below 8.6.0, a user who holds a role…2.7
- CVE-2026-76369In Splunk SOAR versions below 8.6.0, a user who holds the On…2.7
- CVE-2026-7637The Boost plugin for WordPress is vulnerable to PHP Object I…9.8
- CVE-2026-76370In Splunk SOAR versions below 8.6.0, an authenticated user w…4.3
- CVE-2026-76372In Nmap Scanner versions below 3.0.15, a user who holds a ro…6.6
- CVE-2026-76373In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, …5.4
- CVE-2026-76374In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, …4.3
- CVE-2026-76375In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, …5
- CVE-2026-76376In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, …4.3
- CVE-2026-76377In versions below 2.5.3 of the Azure AD Graph app for Splunk…4.3
Are you affected by CVE-2026-76371?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST