The flaw allows an unauthenticated attacker to inject ANSI escape codes into application log files by using malformed HTTP request paths. This injection, classified as CWE-117, means the logs are written with unescaped control characters that a terminal emulator interprets when an administrator opens the files. While the server does not execute arbitrary code, the injected codes could modify log display, trigger unintended terminal behavior, or create a denial‑of‑service situation for users reviewing the logs.

Splunk SOAR – all versions earlier than 8.5.0 are vulnerable. The vulnerability affects the Splunk Security Orchestration, Automation, and Response platform; other Splunk products are not mentioned in the advisories.

The CVSS base score is 4.3, indicating moderate risk. No EPSS score is available, so the precise exploitation likelihood cannot be quantified, but the vulnerability requires unauthenticated access to the SOAR HTTP interface and only alters log content. The flaw is not listed in the CISA KEV catalog and no public exploits have been reported, which suggests a lower likelihood of active exploitation. However, because the injected escape characters can affect log visibility and potentially cause confusion, administrators should treat the issue as a moderate risk that could degrade operational visibility.