# CVE-2026-76369: Path Traversal through Automation Broker in Splunk SOAR

> CVE-2026-76369: Path Traversal through Automation Broker in Splunk SOAR. CVSS 2.7 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-76369
Last updated: 2026-08-21T14:46:18Z

- Published: 2026-08-19 21:34 UTC · Updated: 2026-08-21 14:46 UTC · Assigner: cisco
- CVSS: 2.7 (CVSS 3.1) · Severity: Low · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- EPSS: 0.35%, 29th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-22

## Description

In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the intended Automation Broker log directory. The vulnerability is possible because Automation Broker log uploads accept crafted filename input before writing log files. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) and About Splunk SOAR Automation Broker (https://help.splunk.com/en/splunk-soar/splunk-automation-broker/about-splunk-soar-automation-broker/about-splunk-soar-automation-broker) in the Splunk documentation.

## Affected vendors and products

- Splunk: Splunk SOAR

## Tracked companies

- [Splunk](https://rewindex.com/company/splunk.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-76369)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-76369)
- [https://advisory.splunk.com/advisories/SVD-2026-0804](https://advisory.splunk.com/advisories/SVD-2026-0804)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-76369 · Markdown: https://rewindex.com/cve/CVE-2026-76369.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-76369 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:14:47.724Z