# CVE-2026-76357: Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAR

> CVE-2026-76357: Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAR. CVSS 7.6 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-76357
Last updated: 2026-08-21T14:44:06Z

- Published: 2026-08-19 21:34 UTC · Updated: 2026-08-21 14:44 UTC · Assigner: cisco
- CVSS: 7.6 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
- EPSS: 0.44%, 37th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-22

## Description

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the Representational State Transfer (REST) API and execute arbitrary code. The vulnerability is possible because the REST API does not require an assigned role for the request and does not restrict the user-supplied file path to the intended temporary directory. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Splunk SOAR (On-premises) security information (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/introduction-to-splunk-soar-on-premises/splunk-soar-on-premises-security-information) in the Splunk documentation.

## Affected vendors and products

- Splunk: Splunk SOAR

## Tracked companies

- [Splunk](https://rewindex.com/company/splunk.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-76357)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-76357)
- [https://advisory.splunk.com/advisories/SVD-2026-0804](https://advisory.splunk.com/advisories/SVD-2026-0804)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-76357 · Markdown: https://rewindex.com/cve/CVE-2026-76357.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-76357 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:14:29.039Z