CVE-2026-76372

Name of the Vulnerable Software and Affected Versions Nmap Scanner versions prior to 3.0.15

Description A user with permissions to edit, create, or run playbooks in Splunk SOAR can execute the scan network action within a Safe Mode playbook, despite the action being marked as read-only. This occurs because the connector action manifest incorrectly classifies the scan network action as read-only, while it still accepts script parameters that can perform write operations. This flaw could allow for command execution or unauthorized changes on a target system via Nmap Scripting Engine scripts.

Recommendations Update Nmap Scanner to version 3.0.15 or later.