# CVE-2026-76356: Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAR

> CVE-2026-76356: Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAR. CVSS 8.1 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-76356
Last updated: 2026-08-27T17:20:16Z

- Published: 2026-08-19 21:34 UTC · Updated: 2026-08-27 17:20 UTC · Assigner: cisco
- CVSS: 8.1 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS: 0.61%, 49th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-290

## Description

In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to an Automation Broker notification endpoint and execute arbitrary code on the Splunk SOAR host. The vulnerability is possible because the Splunk SOAR Automation Broker trusts a client-supplied source IP address header as proof that the request originates from the local system. Successful exploitation can expose all relevant data, affect system integrity, and disrupt service availability. For more information see About Splunk SOAR Automation Broker (https://help.splunk.com/en/splunk-soar/splunk-automation-broker/about-splunk-soar-automation-broker/about-splunk-soar-automation-broker) in the Splunk documentation.

## Affected vendors and products

- Splunk: Splunk SOAR

## Tracked companies

- [Splunk](https://rewindex.com/company/splunk.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-76356)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-76356)
- [https://advisory.splunk.com/advisories/SVD-2026-0804](https://advisory.splunk.com/advisories/SVD-2026-0804)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-76356 · Markdown: https://rewindex.com/cve/CVE-2026-76356.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-76356 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:01:36.707Z