# CVE-2026-76361: Server-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAR

> CVE-2026-76361: Server-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAR. CVSS 2.7 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-76361
Last updated: 2026-08-21T14:45:28Z

- Published: 2026-08-19 21:34 UTC · Updated: 2026-08-21 14:45 UTC · Assigner: cisco
- CVSS: 2.7 (CVSS 3.1) · Severity: Low · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- EPSS: 0.30%, 22th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-918

## Description

In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../check\_connectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The Server-Side Request Forgery (SSRF) is possible because the connectivity check REST API does not sufficiently validate the destination before Splunk SOAR connects to it. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.

## Affected vendors and products

- Splunk: Splunk SOAR

## Tracked companies

- [Splunk](https://rewindex.com/company/splunk.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-76361)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-76361)
- [https://advisory.splunk.com/advisories/SVD-2026-0804](https://advisory.splunk.com/advisories/SVD-2026-0804)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-76361 · Markdown: https://rewindex.com/cve/CVE-2026-76361.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-76361 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:11:23.932Z