CVE-2026-76359

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0

Description A user with the Administrator role can perform path traversal during the archive extraction process of the Universal Forwarder installer. This occurs because the credentials-package extraction workflow fails to verify that archive members remain within the intended destination, allowing files to be written outside the designated installation directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths.

Recommendations Update to version 8.6.0 or later.