CVE-2026-76528

CriticalCVSS 9.8/10Last modified Nov 2, 2026

Description

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76528 are related to protection mechanism failure and are grouped under the Common Weakness Enumeration (CWE) CWE-693.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-693

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Splunk	Splunk SOAR	< 8.7.0

References

https://advisory.splunk.com/advisories/SVD-2026-1011

Timeline

Published: Oct 21, 2026
Last modified: Nov 2, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-765299.8As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie CVE-2026-76536.3A security flaw has been discovered in r-huijts mcp-server-rijksmuseum up to 1.0.4. Affected is the function open_image_in_browser of the fi CVE-2026-765308.8As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie CVE-2026-765319.9As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie CVE-2026-76548.8The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution in versions up to and includin CVE-2026-765466.8The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a CVE-2026-765476.6The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration CVE-2026-765488.2The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticat CVE-2026-765495.9The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actio CVE-2026-76558.1The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This i CVE-2026-765507.2The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing u CVE-2026-765517.2The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allow