# CVE-2026-76367: Stored Cross-Site Scripting (XSS) through Notes in Splunk SOAR

> CVE-2026-76367: Stored Cross-Site Scripting (XSS) through Notes in Splunk SOAR. CVSS 4.0 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-76367
Last updated: 2026-08-26T16:16:41Z

- Published: 2026-08-19 21:34 UTC · Updated: 2026-08-26 16:16 UTC · Assigner: cisco
- CVSS: 4.0 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N
- EPSS: 0.20%, 9th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-79

## Description

In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the browser of another user when that user opens the note. The stored Cross-Site Scripting (XSS) vulnerability is possible because Splunk SOAR can treat existing note content as Hypertext Markup Language (HTML) without sanitizing that content when the note format changes. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "Incident Commander" Splunk SOAR role should not be able to exploit the vulnerability at will. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) in the Splunk documentation.

## Affected vendors and products

- Splunk: Splunk SOAR

## Tracked companies

- [Splunk](https://rewindex.com/company/splunk.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-76367)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-76367)
- [https://advisory.splunk.com/advisories/SVD-2026-0804](https://advisory.splunk.com/advisories/SVD-2026-0804)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-76367 · Markdown: https://rewindex.com/cve/CVE-2026-76367.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-76367 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:46:52.050Z