{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76364", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2026-08-19T12:02:03.629Z", "datePublished": "2026-08-19T21:34:53.480Z", "dateUpdated": "2026-08-20T16:27:33.883Z"}, "containers": {"cna": {"affected": [{"product": "Splunk SOAR", "vendor": "Splunk", "versions": [{"version": "8.6", "status": "affected", "versionType": "custom", "lessThan": "8.6.0"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/markdown", "value": "In Splunk SOAR versions below 8.6.0, a user who holds the \"Automation Engineer\" Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database through custom function results, allowing for reading all relevant data stored in the Splunk SOAR database and affecting system integrity. The SQL injection is possible because Splunk SOAR builds the database lookup with the supplied name instead of a bound SQL value. For more information see [Manage roles and permissions in Splunk SOAR (Cloud)](https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) in the Splunk documentation."}], "value": "In Splunk SOAR versions below 8.6.0, a user who holds the \"Automation Engineer\" Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database through custom function results, allowing for reading all relevant data stored in the Splunk SOAR database and affecting system integrity. The SQL injection is possible because Splunk SOAR builds the database lookup with the supplied name instead of a bound SQL value. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) in the Splunk documentation."}], "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2026-0804"}], "title": "Structured Query Language (SQL) Injection through Custom Function Results in Splunk SOAR", "datePublic": "2026-08-19T00:00:00.000Z", "metrics": [{"cvssV3_1": {"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-89", "description": "The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component."}]}], "source": {"advisory": "SVD-2026-0804"}, "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-08-19T21:34:53.480Z"}, "solutions": [{"lang": "en", "value": "Upgrade Splunk SOAR to 8.6.0 or higher."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-76364", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-20T16:13:37.939282Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T16:27:33.883Z"}}]}}

{}

{"affected": [{"affectedData": [{"product": "Splunk SOAR", "vendor": "Splunk", "versions": [{"lessThan": "8.6.0", "status": "affected", "version": "8.6", "versionType": "custom"}]}], "source": "psirt@cisco.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Splunk SOAR versions below 8.6.0, a user who holds the \"Automation Engineer\" Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database through custom function results, allowing for reading all relevant data stored in the Splunk SOAR database and affecting system integrity. The SQL injection is possible because Splunk SOAR builds the database lookup with the supplied name instead of a bound SQL value. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) in the Splunk documentation."}], "id": "CVE-2026-76364", "lastModified": "2026-08-20T17:19:45.490", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76364", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T16:13:37.939282Z", "version": "2.0.3"}}]}, "published": "2026-08-19T22:17:21.777", "references": [{"source": "psirt@cisco.com", "url": "https://advisory.splunk.com/advisories/SVD-2026-0804"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"created": "2026-08-20T11:00:04.814983+00:00", "updated": "2026-08-20T11:00:04.814988+00:00", "vendors": []}