CVE-2026-76375
Medium
Description
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
SeverityMedium
CVSS5.0
Exploit probability—
ProductAD LDAP app for Splunk SOAR
PublishedAug 19, 2026
First seenAug 19, 2026
Weakness typeCWE-532CWE-532
How to fix
Update
- Splunk AD LDAP app for Splunk SOAR2.3.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Splunk AD LDAP app for Splunk SOAR | 2.3 ≤ v < 2.3.8 | 2.3.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.