CVE-2026-76367: Stored Cross-Site Scripting (XSS) through Notes in Splunk SOAR
In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the browser of another user when that user opens the note. The stored Cross-Site Scripting (XSS) vulnerability is possible because Splunk SOAR can treat existing note content as Hypertext Markup Language (HTML) without sanitizing that content when the note format changes. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "Incident Commander" Splunk SOAR role should not be able to exploit the vulnerability at will. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk SOARto a version that resolves this vulnerability.Fixed in 8.6.0
Event History
Frequently Asked Questions
Who can create the malicious note content?
Exploitation requires a Splunk SOAR user with the "Incident Commander" role. The issue is not described as exploitable at will by that user; they must also successfully phish an affected user.
What must happen for the stored script to execute?
Another user must open the affected note and be tricked into initiating a request in their browser. The vulnerable behavior occurs when existing note content is treated as HTML without sanitization after the note format changes.
Which versions are affected?
Splunk SOAR versions below 8.6.0 are affected.