The vulnerability arises from improper protection of alternate paths in Splunk SOAR, a weakness that allows an attacker to circumvent normal access controls by specifying unintended file system paths. Because the application does not enforce strict validation or privilege checks on these alternate paths, an adversary could read or modify sensitive files, achieve unauthorized data manipulation, or elevate privileges within the system. This flaw falls under CWE-424, indicating improper restriction of operations within commands.

The vulnerability affects Splunk SOAR products. Vendor: Splunk; product: Splunk SOAR. The affected versions are not enumerated in the CVE, so any installation using older versions prior to the 8.7.0 release may be vulnerable.

EPSS score of < 1% and the vulnerability not listed in the CISA KEV catalog indicate that exploitation is not widely observed, yet the CVSS score of 9.8 indicates high severity. Based on the nature of the issue, the likely attack vector involves leveraging an exposed API or web interface that accepts path parameters, potentially requiring authenticated access but allowing path traversal. The risk remains significant if the alternate path mechanisms are reachable by privileged users.