CVE-2026-76371— Incorrect Permission Assignment through Safe Mode in FireAMP for Splunk SOAR
Quick assessment
Affected
Splunk FireAMP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 FireAMP 版本低于 2.1.15 的环境中，拥有在 Splunk SOAR 中编辑、创建或运行剧本（playbook）权限的用户，可以在“安全模式”（Safe Mode）剧本中执行“添加列表项”（add listitem）动作，尽管该动作在元数据中被标记为只读。这可能导致对文件列表的未经授权的修改。 该漏洞的存在是因为 FireAMP 连接器动作的清单（action manifest）将“add listitem”动作错误地分类为只读，而实际上该动作会更新文件列表。 有关更多详细信息，请参阅 Splunk
Possible ATT&CK Techniques 1 AI
T1546.001 · Change Default File Association
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76371
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Incorrect Permission Assignment through Safe Mode in FireAMP for Splunk SOAR
Source: CVE Program / CVE List V5
Vulnerability Description
In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to file lists. The vulnerability is possible because the FireAMP connector action manifest classifies the add listitem action as read-only even though the action updates file lists. For more information see Manage settings for a playbook in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/manage-settings-for-a-playbook-in-splunk-soar-cloud) in the Splunk documentation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键资源的不正确权限授予
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-76371
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76371
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-76371 (1)
Same Patch Batch · Splunk · 2026-08-19 · 110 CVEs total
| CVE-2026-76311 | 9.4 CRITICAL | Improper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise |
| CVE-2026-76310 | 9.4 CRITICAL | Improper Access Control through Embedded Report REST API Requests in Splunk Enterprise |
| CVE-2026-76312 | 9.4 CRITICAL | Improper Access Control through Embedded Reports in Splunk Enterprise |
| CVE-2026-76404 | 9.1 CRITICAL | Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server |
| CVE-2026-76335 | 8.8 HIGH | Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise |
| CVE-2026-76350 | 8.8 HIGH | Improper Privilege Management through PDF Attachments for Email Alert Actions in Splunk En |
| CVE-2026-76389 | 8.8 HIGH | Server-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intelligence for En |
| CVE-2026-76351 | 8.8 HIGH | Server-Side Request Forgery (SSRF) through the Report Notification REST API in Splunk Secu |
| CVE-2026-76319 | 8.8 HIGH | Remote Code Execution (RCE) through Federated Search in Splunk Enterprise |
| CVE-2026-76316 | 8.8 HIGH | Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise |
| CVE-2026-76395 | 8.8 HIGH | Remote Code Execution (RCE) through Deserialization of Untrusted Data in the Model Loading |
| CVE-2026-76253 | 8.8 HIGH | Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterpr |
| CVE-2026-76352 | 8.8 HIGH | Improper Authorization through the REST API in Splunk Enterprise |
| CVE-2026-76315 | 8.8 HIGH | Code Injection through Splunk Web Manager Configuration in Splunk Enterprise |
| CVE-2026-76259 | 8.8 HIGH | Improper Privilege Management on the Management Port in Splunk Enterprise for Windows |
| CVE-2026-76317 | 8.8 HIGH | Path Traversal through the Lookup Configuration REST API in Splunk Enterprise |
| CVE-2026-76314 | 8.8 HIGH | Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise |
| CVE-2026-76313 | 8.8 HIGH | Remote Code Execution (RCE) through the REST API in Splunk Enterprise |
| CVE-2026-76394 | 8.3 HIGH | Missing Authorization in Container and Connection Management through the REST API in Splun |
| CVE-2026-76391 | 8.3 HIGH | Improper Privilege Management through Agent Run History in Splunk AI Toolkit |
Showing top 20 of 110 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Splunk
-
CVE-2026-76405
Information Disclosure through Cleartext Storage in the App -
CVE-2026-76403
Improper Certificate Validation through HTTP Event Collector -
CVE-2026-76404
Remote Code Execution (RCE) through Deserialization of Untru -
CVE-2026-76401
Regular Expression Denial of Service (DoS) through the REST -
CVE-2026-76402
Server-Side Request Forgery (SSRF) through the REST API in S
Same weakness: CWE-732
-
CVE-2026-14208
Local Privilege Escalation via Insecure DLL Permissions in R -
CVE-2026-18270
Kenwood DNR1007XR udhcpd Incorrect Permission Assignment Loc -
CVE-2026-76399
Incorrect Permission Assignment for Scheduled Searches in Sp -
CVE-2026-76388
Privilege Escalation through Search Macro Permissions in Spl -
CVE-2026-76372
Incorrect Permission Assignment through Safe Mode in Nmap Sc
V. Comments for CVE-2026-76371
No comments yet