A flaw in Splunk SOAR permits external parties to read files or directories that should be restricted, exposing potentially sensitive data. The weakness is identified as CWE-552, an Access Control issue where unintended information is exposed. The result is the unauthorized disclosure of data that may contain configuration details, user credentials, or other confidential information, which could be used for further malicious activity.

Splunk SOAR systems running versions prior to 8.7.0 are affected. The advisory recommends updating to 8.7.0 or later, as these releases contain the fix that removes the unintended file and directory accessibility.

The advisory lists a CVSS score of 9.9 and an EPSS score of < 1%, indicating a severe vulnerability and a low probability of exploitation. The likely attack vector is inferred to be via network access to the Splunk SOAR instance, potentially from an external host or a compromised internal host that can reach the internal network exposed to the Internet. Attackers capable of such access can exploit the flaw to download or read protected files and directories. Because the vulnerability impacts data confidentiality and potentially integrity, it should be considered high risk for environments handling sensitive or regulated data. The issue is not currently listed in CISA’s KEV catalog, yet the presence of a public advisory and the nature of the exposure warrant immediate action.