CVE-2026-76372

In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system through Nmap Scripting Engine scripts. The vulnerability is possible because the Nmap Scanner connector action manifest classifies the scan network action as read-only even though the action accepts script parameters that can perform write operations. For more information see Manage settings for a playbook in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/manage-settings-for-a-playbook-in-splunk-soar-cloud) in the Splunk documentation.

• CWE-732

• https://advisory.splunk.com/advisories/SVD-2026-0806

Published

Aug 19, 2026

Last Modified

Aug 20, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76367In Splunk SOAR versions below 8.6.0, a user who holds the "I…4
• CVE-2026-76368In Splunk SOAR versions below 8.6.0, a user who holds a role…2.7
• CVE-2026-76369In Splunk SOAR versions below 8.6.0, a user who holds the On…2.7
• CVE-2026-7637The Boost plugin for WordPress is vulnerable to PHP Object I…9.8
• CVE-2026-76370In Splunk SOAR versions below 8.6.0, an authenticated user w…4.3
• CVE-2026-76371In FireAMP versions below 2.1.15, a user who holds a role th…2.7
• CVE-2026-76373In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, …5.4
• CVE-2026-76374In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, …4.3
• CVE-2026-76375In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, …5
• CVE-2026-76376In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, …4.3
• CVE-2026-76377In versions below 2.5.3 of the Azure AD Graph app for Splunk…4.3
• CVE-2026-76378In versions below 2.4.5 of the Cisco Secure Malware Analytic…4.3