CVE-2026-76367

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0

Description A stored Cross-Site Scripting (XSS) issue exists where a user with the "Incident Commander" role can store JavaScript within a note. This occurs because the system may treat note content as Hypertext Markup Language (HTML) without proper sanitization when the note format changes. An attacker can execute this script in the browser of another user by tricking them into opening the malicious note via phishing.

Recommendations Update to version 8.6.0 or later.