CVE-2026-76375
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext.
Risk Assessment
Risk of exposing credentials in log files, potentially leading to unauthorized access to systems and data.
Recommendation
Update the AD LDAP app to version 2.3.8 or later to prevent writing process environment to log files.
Other vulnerabilities in AD LDAP app for Splunk SOAR
See all- CVE-2026-76374Medium
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app.
- CVE-2026-76373Medium
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user with permission to run actions could inject crafted input into an Active Directory query to enumerate Active Directory objects, including accounts, groups, and organizational units, read sensitive attributes from arbitrary directory objects, and redirect account modification actions to unintended objects.
Original NVD description (English source)
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).