CVE-2026-76364

CVE-2026-76364 is a SQL injection vulnerability in Splunk SOAR's Automation Engineer role, but labeling it as an input sanitization issue obscures what actually makes this dangerous. The vulnerability exists because Splunk designed the Automation Engineer role to include database lookup capabilities that deliberately incorporate user-supplied values into queries. That's not a coding oversight — it's an architectural decision that created a SQL injection path as a feature of the permission model. The CVSS 6.5 score is misaligned with the actual risk profile. Standard SQL injection assumes you need to find an exposed entry point and develop exploit tooling. This vulnerability requires neither. An attacker with valid Automation Engineer credentials — whether compromised or insider — uses documented product features (custom function results) to poison SQL queries. The 'low exploitability' EPSS prediction measures external attack probability, but this CVE's threat model is credential compromise and insider access, not external exploitation. The EPSS signal is accurate for the wrong attacker type, creating a dangerous illusion of safety. The blast radius is the critical concern. Splunk SOAR is the hub connecting your entire security stack. Compromising its database doesn't just expose incident tickets — it exposes playbook logic that defines your automated response procedures, integration credentials that connect to every tool in your environment, and custom function code that specifies what automated actions SOAR can take. Once an attacker has read access to this database, there's no compensating control between 'read playbook A' and 'read every credential SOAR has stored for every integration.' The database IS the hub, and compromising it compromises everything downstream. Assume complete database compromise until Splunk explicitly confirms segregation. Patch immediately regardless of the medium severity classification. Rotate all integration credentials stored in SOAR after applying the patch — the exposure window runs from disclosure through patch deployment AND credential rotation, not just patch deployment. Treat this as a credential theft vulnerability with catastrophic blast radius, not a medium-severity SQL injection.

Reviewed through automated stages and approved by a human before publication.