# CVE-2026-76364: Structured Query Language (SQL) Injection through Custom Function Results in Splunk SOAR

> CVE-2026-76364: Structured Query Language (SQL) Injection through Custom Function Results in Splunk SOAR. CVSS 6.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-76364
Last updated: 2026-08-21T14:47:22Z

- Published: 2026-08-19 21:34 UTC · Updated: 2026-08-21 14:47 UTC · Assigner: cisco
- CVSS: 6.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
- EPSS: 0.40%, 34th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-89

## Description

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database through custom function results, allowing for reading all relevant data stored in the Splunk SOAR database and affecting system integrity. The SQL injection is possible because Splunk SOAR builds the database lookup with the supplied name instead of a bound SQL value. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) in the Splunk documentation.

## Affected vendors and products

- Splunk: Splunk SOAR

## Tracked companies

- [Splunk](https://rewindex.com/company/splunk.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-76364)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-76364)
- [https://advisory.splunk.com/advisories/SVD-2026-0804](https://advisory.splunk.com/advisories/SVD-2026-0804)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-76364 · Markdown: https://rewindex.com/cve/CVE-2026-76364.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-76364 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:15:28.132Z