CVE-2026-76373
Last modified
CVE-2026-76373 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could inject crafted input into an Active Directory query to enumerate Active Directory objects, including accounts, groups, and organizational units, read sensitive attributes from arbitrary directory objects, and redirect account modification actions to unintended objects. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).. EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could inject crafted input into an Active Directory query to enumerate Active Directory objects, including accounts, groups, and organizational units, read sensitive attributes from arbitrary directory objects, and redirect account modification actions to unintended objects. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Splunk | AD LDAP app for Splunk SOAR | >= 2.3, < 2.3.8 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-76373?
How severe is CVE-2026-76373?
How do I fix CVE-2026-76373?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-76368In Splunk SOAR versions below 8.6.0, a user who holds a role…2.7
- CVE-2026-76369In Splunk SOAR versions below 8.6.0, a user who holds the On…2.7
- CVE-2026-7637The Boost plugin for WordPress is vulnerable to PHP Object I…9.8
- CVE-2026-76370In Splunk SOAR versions below 8.6.0, an authenticated user w…4.3
- CVE-2026-76371In FireAMP versions below 2.1.15, a user who holds a role th…2.7
- CVE-2026-76372In Nmap Scanner versions below 3.0.15, a user who holds a ro…6.6
- CVE-2026-76374In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, …4.3
- CVE-2026-76375In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, …5
- CVE-2026-76376In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, …4.3
- CVE-2026-76377In versions below 2.5.3 of the Azure AD Graph app for Splunk…4.3
- CVE-2026-76378In versions below 2.4.5 of the Cisco Secure Malware Analytic…4.3
- CVE-2026-76379In versions below 2.2.1 of the Cisco Webex app for Splunk SO…4.3
Are you affected by CVE-2026-76373?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST