CVE-2026-76372 Incorrect Permission Assignment through Safe Mode in Nmap Scanner for Splunk SOAR
Users with playbook editing rights can execute arbitrary commands on target systems via Nmap scripts in Safe Mode due to incorrect permission checks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76372?
CVE-2026-76372 is a medium-severity missing authorization vulnerability in Splunk Nmap Scanner, published on 19 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system through Nmap Scripting Engine scripts. The vulnerability is possible because the Nmap Scanner connector action manifest classifies the scan network action as read-only even though the action accepts script parameters that can perform write operations. For more information see Manage settings for a playbook in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/manage-settings-for-a-playbook-in-splunk-soar-cloud) in the Splunk documentation.
Weakness: CWE-732
Which versions are affected by CVE-2026-76372?
How do I fix CVE-2026-76372?
No fix has been published for CVE-2026-76372 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-76372 being exploited?
There is no known exploitation of CVE-2026-76372 in the wild and no public exploit code.
Sources
Also known as GHSA-5x32-67q6-rxx3.