CVE-2026-76363

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0

Description A user with the Automation Engineer role can execute arbitrary Structured Query Language (SQL) statements against the database. This allows for the creation, reading, updating, or deletion of all data within the database. The issue occurs because playbook automation data APIs incorporate user-supplied input into database queries without proper neutralization, leading to SQL injection (a technique where malicious SQL code is inserted into input fields for execution).

Recommendations Update to version 8.6.0 or later.