# CVE-2026-76373: Filter Injection through Action Parameters in AD LDAP app for Splunk SOAR

> CVE-2026-76373: Filter Injection through Action Parameters in AD LDAP app for Splunk SOAR. CVSS 5.4 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-76373
Last updated: 2026-08-20T17:19:46Z

- Published: 2026-08-19 21:34 UTC · Updated: 2026-08-20 17:19 UTC · Assigner: cisco
- CVSS: 5.4 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- EPSS: 0.25%, 16th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-90

## Description

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could inject crafted input into an Active Directory query to enumerate Active Directory objects, including accounts, groups, and organizational units, read sensitive attributes from arbitrary directory objects, and redirect account modification actions to unintended objects. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

## Affected vendors and products

- Splunk: AD LDAP app for Splunk SOAR

## Tracked companies

- [Splunk](https://rewindex.com/company/splunk.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-76373)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-76373)
- [https://advisory.splunk.com/advisories/SVD-2026-0806](https://advisory.splunk.com/advisories/SVD-2026-0806)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-76373 · Markdown: https://rewindex.com/cve/CVE-2026-76373.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-76373 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:15:14.217Z