CVE-2026-76362: splunk soar Improper Certificate Validation

Vulnerability summary

CVE-2026-76362 is a high (CVSS 7.4) Improper Certificate Validation vulnerability in splunk soar. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11.1% of scored vulnerabilities.

Timeline

1. 19-08-2026
   PublishedVulnerability first disclosed.
2. 21-08-2026
   Last modifiedVulnerability information updated.

Description

In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer (REST) server could access or modify all relevant data exchanged through that credential manager. The vulnerability is possible because the CyberArk REST client does not verify server certificates by default. The attack requires the attacker to have network-path interception capability between Splunk SOAR and the configured CyberArk REST server. For more information see Manage your organization's credentials with a password vault (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/configure-administration-settings-in-splunk-soar-cloud/manage-your-organizations-credentials-with-a-password-vault) in the Splunk documentation.

• CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.