CVE-2026-76367 Stored Cross-Site Scripting (XSS) through Notes in Splunk SOAR
An Incident Commander can inject malicious JavaScript into notes, executing it in other users' browsers to potentially hijack sessions or execute code.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-76367?
CVE-2026-76367 is a medium-severity cross-site scripting vulnerability in Splunk SOAR, published on 19 Aug 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the browser of another user when that user opens the note. The stored Cross-Site Scripting (XSS) vulnerability is possible because Splunk SOAR can treat existing note content as Hypertext Markup Language (HTML) without sanitizing that content when the note format changes. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "Incident Commander" Splunk SOAR role should not be able to exploit the vulnerability at will. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) in the Splunk documentation.
Weakness: CWE-79
Which versions are affected by CVE-2026-76367?
It affects 1 product.
Products include Splunk Soar.
How do I fix CVE-2026-76367?
No fix has been published for CVE-2026-76367 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-76367 being exploited?
There is no known exploitation of CVE-2026-76367 in the wild and no public exploit code.
Other vulnerabilities in Splunk SOAR
- CVE-2023-3997 Unauthenticated Log Injection In Splunk SOAR
- CVE-2026-76356 Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAR
- CVE-2026-76357 Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAR
- CVE-2026-76362 Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOAR
- CVE-2026-76358 Path Traversal through App Installation Tar Extraction in Splunk SOAR
Sources
Also known as GHSA-w7fq-wgjx-63h9.