CVE-2026-76373
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user with permission to run actions could inject crafted input into an Active Directory query to enumerate Active Directory objects, including accounts, groups, and organizational units, read sensitive attributes from arbitrary directory objects, and redirect account modification actions to unintended objects.
Risk Assessment
Risk of unauthorized access to Active Directory data and account manipulation, potentially leading to domain-wide security compromise.
Recommendation
Update the AD LDAP app to version 2.3.8 or later to prevent input injection into queries.
Other vulnerabilities in AD LDAP app for Splunk SOAR
See all- CVE-2026-76375Medium
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext.
- CVE-2026-76374Medium
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app.
Original NVD description (English source)
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could inject crafted input into an Active Directory query to enumerate Active Directory objects, including accounts, groups, and organizational units, read sensitive attributes from arbitrary directory objects, and redirect account modification actions to unintended objects. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).