Description
In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State Transfer (REST) API and cause Splunk SOAR to apply the license change.
The vulnerability is possible because Splunk SOAR authenticates requests to manage the Enterprise Security edition but does not authorize the caller before it applies the license change.
For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.7.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Obtain and configure a Splunk SOAR (On-premises) license (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.7.0/configure-your-companys-settings-in-splunk-soar-on-premises/obtain-and-configure-a-splunk-soar-on-premises-license), and Integration of Splunk SOAR with Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.7/automation-with-playbooks/integration-of-splunk-soar-with-splunk-enterprise-security) in the Splunk documentation.
Published: 2026-10-21
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized License Modification
Action: Upgrade
AI Analysis

Impact

The vulnerability arises from a missing authorization check on a REST API endpoint that changes the Enterprise Security edition license. An authenticated user can invoke the API to alter license settings without being verified for proper privileges. This flaw, classified as CWE‑862, permits an attacker to modify the licensing configuration, potentially impacting service functionality, availability, and the confidentiality of privileged data due to unauthorized license changes.

Affected Systems

The affected product is Splunk SOAR, specifically all versions prior to 8.7.0. Users running these older releases are susceptible if they have access to the REST API.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate risk. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authentication, but the attacker need not have administrative rights; any credentialed user may issue the API call. Attackers can target the REST API over the network, making the flaw accessible to anyone with legitimate access. Due to the lack of authorization checks, the likelihood of successful exploitation is significant for environments with broad API privileges.

Generated by OpenCVE AI on October 22, 2026 at 05:12 UTC.

Remediation

Vendor Solution

Upgrade Splunk SOAR to version 8.7.0 or higher.

OpenCVE Recommended Actions

  • Upgrade Splunk SOAR to version 8.7.0 or newer.
  • Limit REST API access to privileged roles by reviewing and adjusting role-based access controls.
  • Apply network segmentation or API gateway rules to restrict the license change endpoint to authorized users.

Generated by OpenCVE AI on October 22, 2026 at 05:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Splunk
Splunk splunk
Vendors & Products Splunk
Splunk splunk

Wed, 21 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Description In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State Transfer (REST) API and cause Splunk SOAR to apply the license change. The vulnerability is possible because Splunk SOAR authenticates requests to manage the Enterprise Security edition but does not authorize the caller before it applies the license change. For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.7.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Obtain and configure a Splunk SOAR (On-premises) license (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.7.0/configure-your-companys-settings-in-splunk-soar-on-premises/obtain-and-configure-a-splunk-soar-on-premises-license), and Integration of Splunk SOAR with Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.7/automation-with-playbooks/integration-of-splunk-soar-with-splunk-enterprise-security) in the Splunk documentation.
Title Missing Authorization through the REST API in Splunk SOAR
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Splunk Splunk
cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-10-26T16:46:46.763Z

Reserved: 2026-08-19T12:02:03.624Z

Link: CVE-2026-76308

cve-icon Vulnrichment

Updated: 2026-10-26T16:41:29.336Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-10-21T23:17:29.017

Modified: 2026-10-26T17:17:29.490

Link: CVE-2026-76308

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T10:30:04Z

Weaknesses