CVE-2026-76362 Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOAR
An attacker with network interception can bypass certificate validation to read or modify data exchanged between Splunk SOAR and CyberArk.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76362?
CVE-2026-76362 is a high-severity vulnerability in Splunk SOAR, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer (REST) server could access or modify all relevant data exchanged through that credential manager. The vulnerability is possible because the CyberArk REST client does not verify server certificates by default. The attack requires the attacker to have network-path interception capability between Splunk SOAR and the configured CyberArk REST server. For more information see Manage your organization's credentials with a password vault (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/configure-administration-settings-in-splunk-soar-cloud/manage-your-organizations-credentials-with-a-password-vault) in the Splunk documentation.
Weakness: CWE-295
Which versions are affected by CVE-2026-76362?
It affects 1 product.
Products include Splunk Soar.
How do I fix CVE-2026-76362?
No fix has been published for CVE-2026-76362 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-76362 being exploited?
There is no known exploitation of CVE-2026-76362 in the wild and no public exploit code.
Other vulnerabilities in Splunk SOAR
- CVE-2023-3997 Unauthenticated Log Injection In Splunk SOAR
- CVE-2026-76356 Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAR
- CVE-2026-76357 Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAR
- CVE-2026-76358 Path Traversal through App Installation Tar Extraction in Splunk SOAR
- CVE-2026-76359 Path Traversal through Universal Forwarder Installer Archive Extraction in Splunk SOAR
Sources
Also known as GHSA-m3cr-3q92-cg98.