CVE-2026-76374
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app.
Risk Assessment
Risk of exposing sensitive Active Directory data in log files, potentially leading to confidentiality breaches.
Recommendation
Update the AD LDAP app to version 2.3.8 or later to prevent writing response data to log files.
Other vulnerabilities in AD LDAP app for Splunk SOAR
See all- CVE-2026-76375Medium
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext.
- CVE-2026-76373Medium
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user with permission to run actions could inject crafted input into an Active Directory query to enumerate Active Directory objects, including accounts, groups, and organizational units, read sensitive attributes from arbitrary directory objects, and redirect account modification actions to unintended objects.
Original NVD description (English source)
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).