CVE-2026-76362: Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOAR
In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer (REST) server could access or modify all relevant data exchanged through that credential manager. The vulnerability is possible because the CyberArk REST client does not verify server certificates by default. The attack requires the attacker to have network-path interception capability between Splunk SOAR and the configured CyberArk REST server. For more information see Manage your organization's credentials with a password vault (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/configure-administration-settings-in-splunk-soar-cloud/manage-your-organizations-credentials-with-a-password-vault) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk SOARto a version that resolves this vulnerability.Fixed in 8.6.0 - Configuration
For existing CyberArk REST credential-manager configurations, turn on “Verify server certificate” after upgrading.
CyberArk REST credential-manager Verify server certificate = true
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Splunk SOAR versions below 8.6.0 are affected when they use a configured CyberArk REST server as a credential manager. Exploitation also requires that an attacker can observe or alter traffic on the network path between SOAR and that server.
Does an attacker need a SOAR account or user interaction?
No. The described attacker is unauthenticated and no user interaction is required, but the attacker must have network-path interception capability between Splunk SOAR and the configured CyberArk REST server.
What could an attacker do if they can intercept the connection?
They could access or modify all relevant data exchanged between Splunk SOAR and the CyberArk credential manager. The issue exists because the CyberArk REST client does not verify server certificates by default.
How can teams determine whether they are affected?
Check whether the Splunk SOAR deployment is below version 8.6.0 and whether it is configured to use a CyberArk REST server for credential management. If both conditions apply, the deployment is affected when the SOAR-to-CyberArk network path can be intercepted or altered by an attacker.