{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Splunk heeft meerdere kwetsbaarheden verholpen in Splunk Enterprise.", "title": "Feiten" }, { "category": "description", "text": "In Splunk Enterprise zijn verschillende kwetsbaarheden aanwezig in versies eerder dan 10.4.4 (en enkele andere specifieke versies). Deze omvatten onder andere:\n- onjuiste verificatie in de Data Management REST API waardoor gebruikers met bepaalde rollen toegang kunnen krijgen tot of verwijderen van SPL2 preview jobs en resultaten die zij niet bezitten\n- onvoldoende limieten in request-header parsing in de JavaScript logger endpoint die een Denial-of-Service (DoS) kan veroorzaken\n- misbruik van de REST API voor lookup table files door niet-admin gebruikers om DoS te veroorzaken\n- onvoldoende toegangscontrole op de Edge Processor package download endpoint waardoor ongeauthenticeerde gebruikers overmatig resourcegebruik kunnen veroorzaken\n- het uitvoeren van potentieel gevaarlijke SPL-commando's door gebruikers met schedule_search capability\n- toegang tot mobiele alert notificatiegegevens door laaggeprivilegieerde gebruikers via onvoldoende autorisatie in App Key Value Store REST API\n- uitvoering van willekeurige OS-commando's via onvoldoende restricties in Splunk Web Manager XML configuratie\n- onbevoegde verplaatsing van field extractions of transformations naar niet-toegestane applicaties\n- omzeilen van filterrestricties door gebruikers zonder admin of power rol via onjuiste verwerking van speciale karakters\n- onbevoegde aanpassingen van sourcetype renaming configuraties\n- uitschakeling van federated search providers door phishing van gebruikers met edit_federated_providers capability\n- het afleiden van de PostgreSQL sidecar database superuser wachtwoord door niet-admin gebruikers via blootstelling in zoekjob logs.", "title": "Interpretaties" }, { "category": "description", "text": "Splunk heeft updates uitgebracht om de genoemde kwetsbaarheden in Splunk Enterprise te verhelpen. Zie bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "title": "CWE-79" }, { "category": "general", "text": "Improper Control of Generation of Code ('Code Injection')", "title": "CWE-94" }, { "category": "general", "text": "Observable Discrepancy", "title": "CWE-203" }, { "category": "general", "text": "Use of Hard-coded Cryptographic Key", "title": "CWE-321" }, { "category": "general", "text": "Cross-Site Request Forgery (CSRF)", "title": "CWE-352" }, { "category": "general", "text": "Improper Protection of Alternate Path", "title": "CWE-424" }, { "category": "general", "text": "Files or Directories Accessible to External Parties", "title": "CWE-552" }, { "category": "general", "text": "Authorization Bypass Through User-Controlled Key", "title": "CWE-639" }, { "category": "general", "text": "Use of Non-Canonical URL Paths for Authorization Decisions", "title": "CWE-647" }, { "category": "general", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "general", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "general", "text": "Improper Neutralization of Special Elements in Data Query Logic", "title": "CWE-943" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference", "url": "https://advisory.splunk.com/advisories/SVD-2026-1007" }, { "category": "external", "summary": "Reference", "url": "https://advisory.splunk.com/advisories/SVD-2026-1008" }, { "category": "external", "summary": "Reference", "url": "https://advisory.splunk.com/advisories/SVD-2026-1010" }, { "category": "external", "summary": "Reference", "url": "https://advisory.splunk.com/advisories/SVD-2026-1011" } ], "title": "Kwetsbaarheden verholpen in Splunk Enterprise", "tracking": { "current_release_date": "2026-10-28T09:12:56.548898Z", "generator": { "date": "2025-08-04T16:30:00Z", "engine": { "name": "V.A.", "version": "1.3" } }, "id": "NCSC-2026-0457", "initial_release_date": "2026-10-28T09:12:56.548898Z", "revision_history": [ { "date": "2026-10-28T09:12:56.548898Z", "number": "1.0.0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-1" } } ], "category": "product_name", "name": "Splunk Enterprise" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-2" } } ], "category": "product_name", "name": "Splunk Secure Gateway" } ], "category": "vendor", "name": "Splunk" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-76287", "cwe": { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" }, "notes": [ { "category": "other", "text": "Authorization Bypass Through User-Controlled Key", "title": "CWE-639" }, { "category": "description", "text": "In Splunk Enterprise versions prior to 10.4.4, insufficient verification in the Data Management REST API allowed users with certain roles to improperly access or delete Data Management SPL2 preview jobs and results outside their ownership when the Edge Processor feature was enabled.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76287 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76287.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76287" }, { "cve": "CVE-2026-76288", "notes": [ { "category": "description", "text": "Certain versions of Splunk Enterprise below 10.4.4, 10.2.8, 10.0.11, and 9.4.16 allow an unauthenticated user to cause Splunk Web to become unresponsive by sending a crafted request to the JavaScript logger endpoint due to insufficient request-header parsing limits.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76288 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76288.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76288" }, { "cve": "CVE-2026-76289", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "description", "text": "Certain versions of Splunk Enterprise prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16 allow non-admin or non-power users to cause a denial of service via the REST API endpoint for lookup table files, leading to service disruption requiring a restart.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76289 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76289.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76289" }, { "cve": "CVE-2026-76290", "notes": [ { "category": "description", "text": "Certain versions of Splunk Enterprise prior to 10.4.4, 10.2.8, and 10.0.11 contain a vulnerability in the Edge Processor package download endpoint that allows unauthenticated users to cause excessive resource consumption and potential service disruption.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76290 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76290.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76290" }, { "cve": "CVE-2026-76291", "notes": [ { "category": "description", "text": "Certain versions of Splunk Enterprise prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16 contain a vulnerability allowing users with schedule_search capability to execute unsafe SPL commands in scheduled searches, risking data and system integrity.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76291 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76291.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76291" }, { "cve": "CVE-2026-76292", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "A vulnerability in older versions of Splunk Enterprise and Splunk Secure Gateway allows low-privileged users to access other users' mobile alert notification data due to missing user-level authorization in the App Key Value Store REST API.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76292 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76292.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76292" }, { "cve": "CVE-2026-76293", "cwe": { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')" }, "notes": [ { "category": "other", "text": "Improper Control of Generation of Code ('Code Injection')", "title": "CWE-94" }, { "category": "description", "text": "Certain versions of Splunk Enterprise prior to 10.4.3, 10.2.8, 10.0.11, and 9.4.16 contain a vulnerability in Splunk Web Manager allowing users with edit_manager_xml capability to execute arbitrary OS commands via insufficiently restricted user-controlled expressions in Manager XML.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76293 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76293.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76293" }, { "cve": "CVE-2026-76294", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "Certain versions of Splunk Enterprise prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16 allow non-admin users to improperly move field extractions or transformations to inaccessible apps due to insufficient REST API validation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76294 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76294.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76294" }, { "cve": "CVE-2026-76295", "cwe": { "id": "CWE-943", "name": "Improper Neutralization of Special Elements in Data Query Logic" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements in Data Query Logic", "title": "CWE-943" }, { "category": "description", "text": "Certain older versions of Splunk Enterprise and Splunk Secure Gateway improperly handled special characters in filter creation, allowing users without 'admin' or 'power' roles to view dashboard and report listings beyond their intended scope.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76295 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76295.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76295" }, { "cve": "CVE-2026-76296", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "Certain versions of Splunk Enterprise prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16 allow non-admin and non-power users to improperly modify sourcetype renaming configurations in unauthorized apps due to insufficient permission checks in Splunk Web.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76296 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76296.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76296" }, { "cve": "CVE-2026-76297", "cwe": { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)" }, "notes": [ { "category": "other", "text": "Cross-Site Request Forgery (CSRF)", "title": "CWE-352" }, { "category": "description", "text": "An unauthenticated attacker can exploit a vulnerability in older Splunk Enterprise versions' federated provider REST API to disable all federated search providers via phishing users with edit_federated_providers capability, disrupting federated searches.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76297 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76297.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L", "baseScore": 4.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76297" }, { "cve": "CVE-2026-76298", "cwe": { "id": "CWE-321", "name": "Use of Hard-coded Cryptographic Key" }, "notes": [ { "category": "other", "text": "Use of Hard-coded Cryptographic Key", "title": "CWE-321" }, { "category": "description", "text": "Splunk Enterprise versions below 10.4.4 and 10.2.8 contain a vulnerability allowing non-admin users to extract the PostgreSQL sidecar database superuser password and execute arbitrary OS commands on search head cluster members via exposed cluster identifiers in search job logs.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76298 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76298.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76298" }, { "cve": "CVE-2026-76299", "notes": [ { "category": "description", "text": "Cisco released a software hardening update addressing multiple internally discovered improper access control vulnerabilities, including CVE-2026-76299 categorized under CWE-284.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76299 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76299.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.9, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76299" }, { "cve": "CVE-2026-76300", "notes": [ { "category": "description", "text": "Cisco released a software hardening update addressing multiple vulnerabilities related to improper resource control, specifically CVE-2026-76300, categorized under CWE-664.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76300 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76300.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76300" }, { "cve": "CVE-2026-76301", "notes": [ { "category": "description", "text": "Cisco released a software hardening update addressing multiple vulnerabilities related to protection mechanism failures, specifically CVE-2026-76301, classified under CWE-693.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76301 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76301.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76301" }, { "cve": "CVE-2026-76302", "notes": [ { "category": "description", "text": "Cisco released a software hardening update addressing multiple vulnerabilities, including CVE-2026-76302, related to improper neutralization and classified under CWE-707.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76302 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76302.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.9, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76302" }, { "cve": "CVE-2026-76303", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "title": "CWE-79" }, { "category": "description", "text": "Splunk SOAR versions below 8.7.0 contain a vulnerability allowing users with install_apps capability to inject malicious content into app documentation, which executes in browsers of users viewing apps, risking unauthorized data access and modification.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76303 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76303.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N", "baseScore": 5.7, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76303" }, { "cve": "CVE-2026-76304", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "Splunk SOAR versions below 8.7.0 contain a vulnerability allowing authenticated users without Automation Broker edit permissions to download the Automation Broker Docker Compose configuration file, exposing sensitive instance details due to improper permission enforcement.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76304 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76304.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76304" }, { "cve": "CVE-2026-76305", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "Splunk SOAR versions below 8.7.0 contain a vulnerability allowing authenticated users without app viewing permissions to download app archives, exposing sensitive data due to missing permission verification.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76305 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76305.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76305" }, { "cve": "CVE-2026-76306", "notes": [ { "category": "description", "text": "In Splunk SOAR versions prior to 8.7.0, the 'Observer' role could exploit REST API query filters to access sensitive data like password hashes and authorization tokens due to improper filtering order.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76306 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76306.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76306" }, { "cve": "CVE-2026-76307", "notes": [ { "category": "description", "text": "Splunk SOAR versions below 8.7.0 contain a vulnerability where users with certain permissions can exploit the REST API to infer other users' authentication tokens, potentially gaining administrative access due to insufficient filtering of sensitive fields.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76307 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76307.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76307" }, { "cve": "CVE-2026-76308", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "Splunk SOAR versions prior to 8.7.0 contain a vulnerability allowing authenticated users to alter the Enterprise Security edition license via the REST API without proper authorization, leading to unauthorized license modifications.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76308 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76308.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76308" }, { "cve": "CVE-2026-76406", "cwe": { "id": "CWE-203", "name": "Observable Discrepancy" }, "notes": [ { "category": "other", "text": "Observable Discrepancy", "title": "CWE-203" }, { "category": "description", "text": "In Splunk SOAR versions prior to 8.7.0, a vulnerability in the REST API allowed unauthenticated users with access to encrypted credentials to decrypt Basic authentication data before authentication checks were performed.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76406 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76406.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76406" }, { "cve": "CVE-2026-76407", "notes": [ { "category": "description", "text": "Cisco released a software hardening update addressing multiple improper access control vulnerabilities, including CVE-2026-76407, classified under CWE-284.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76407 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76407.json" } ], "title": "CVE-2026-76407" }, { "cve": "CVE-2026-76408", "notes": [ { "category": "description", "text": "Cisco released a software hardening update addressing multiple vulnerabilities related to improper resource control, specifically CVE-2026-76408, classified under CWE-664.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76408 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76408.json" } ], "title": "CVE-2026-76408" }, { "cve": "CVE-2026-76526", "notes": [ { "category": "description", "text": "Cisco released a software hardening update addressing multiple vulnerabilities, including CVE-2026-76526, related to improper neutralization and classified under CWE-707.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76526 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76526.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76526" }, { "cve": "CVE-2026-76527", "notes": [ { "category": "description", "text": "Cisco has issued a software hardening update to address multiple internally discovered vulnerabilities related to improper handling of exceptional conditions, identified as CVE-2026-76527 and classified under CWE-703.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76527 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76527.json" } ], "title": "CVE-2026-76527" }, { "cve": "CVE-2026-76528", "notes": [ { "category": "description", "text": "Cisco released a software hardening update addressing multiple vulnerabilities, including CVE-2026-76528, related to protection mechanism failures categorized under CWE-693.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76528 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76528.json" } ], "title": "CVE-2026-76528" }, { "cve": "CVE-2026-76529", "cwe": { "id": "CWE-424", "name": "Improper Protection of Alternate Path" }, "notes": [ { "category": "other", "text": "Improper Protection of Alternate Path", "title": "CWE-424" }, { "category": "description", "text": "Cisco has issued a software hardening update to address multiple internally discovered vulnerabilities related to improper protection of alternate paths, identified as CVE-2026-76529 and classified under CWE-424.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76529 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76529.json" } ], "title": "CVE-2026-76529" }, { "cve": "CVE-2026-76530", "cwe": { "id": "CWE-647", "name": "Use of Non-Canonical URL Paths for Authorization Decisions" }, "notes": [ { "category": "other", "text": "Use of Non-Canonical URL Paths for Authorization Decisions", "title": "CWE-647" }, { "category": "description", "text": "Cisco has issued a software hardening update to address multiple internally discovered vulnerabilities involving non-canonical URL path authorization, identified as CVE-2026-76530 and classified under CWE-647.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76530 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76530.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76530" }, { "cve": "CVE-2026-76531", "cwe": { "id": "CWE-552", "name": "Files or Directories Accessible to External Parties" }, "notes": [ { "category": "other", "text": "Files or Directories Accessible to External Parties", "title": "CWE-552" }, { "category": "description", "text": "Cisco has issued a software hardening update to address multiple internally discovered vulnerabilities related to externally accessible files or directories, identified as CVE-2026-76531 and classified under CWE-552.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-76531 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76531.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.9, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-76531" } ] }