CVE-2026-76365

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0

Description A user with the Automation Engineer role can execute arbitrary Structured Query Language (SQL) statements against the database. This occurs during custom list retrieval within a playbook, enabling create, read, update, and delete operations on stored data. The issue stems from the application building the custom list database lookup using the supplied list name instead of a bound SQL value, leading to SQL injection (a technique where malicious SQL code is inserted into input fields for execution).

Recommendations Update to version 8.6.0 or later.