CVE-2026-76531

CriticalCVSS 9.9/10Last modified Oct 22, 2026

Description

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76531 are related to files or directories accessible to external parties and are grouped under the Common Weakness Enumeration (CWE) CWE-552.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-552

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
SplunkSplunk SOAR< 8.7.0

References

Timeline

Published
Oct 21, 2026
Last modified
Oct 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-76548.8The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution in versions up to and includinCVE-2026-765466.8The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a CVE-2026-765476.6The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configurationCVE-2026-765488.2The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticatCVE-2026-765495.9The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actioCVE-2026-76558.1The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This iCVE-2026-765507.2The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing uCVE-2026-765517.2The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowCVE-2026-765528.8The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-CVE-2026-765536.5The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively dCVE-2026-765547.2The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify usCVE-2026-765556.8The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a
CVE-2026-76531: Critical severity, CVSS 9.9 | Vulnix