CVE-2026-76379

Executive Summary

CVE-2026-76379 is an information disclosure vulnerability affecting the Cisco Webex app for Splunk SOAR in versions prior to 2.2.1. The flaw allows any user holding a role with permission to run actions to expose a sensitive meeting password in cleartext within the Splunk SOAR user interface by invoking the schedule meeting action. The root cause is that the app fails to mark the affected action parameter as a password type, meaning it is not masked during display. The vulnerability carries a CVSS score of 4.3 (Medium) with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, and no exploit code or proof-of-concept has been publicly reported at this time.

Technical Analysis

The vulnerability exists in the Cisco Webex app for Splunk SOAR, a SOAR (Security Orchestration, Automation, and Response) integration that allows security teams to automate Webex meetings and related actions within their playbooks and operational workflows. Affected versions are those below 2.2.1.

The underlying mechanism is a credentials-masking deficiency. In the Splunk SOAR platform, action parameters provide user-supplied input to automated actions. When a parameter is defined with the password data type, the platform automatically masks the value in the user interface, displaying asterisks or similar obscured characters to prevent shoulder-surfing and accidental exposure on screen. When a parameter is not marked as a password type, its value is displayed in plaintext.

In the Cisco Webex app, the schedule meeting action defines a parameter intended to hold the meeting password. Because this parameter was not flagged with the password type attribute in the app's action definition, the Splunk SOAR platform does not apply native masking. Therefore, when an authorized user invokes the schedule meeting action, the value of the meeting password parameter is rendered in cleartext within the user interface.

Several important scope limitations define this vulnerability:

1. Privilege Requirement: The attacker must already possess a role in Splunk SOAR that grants permission to run actions. This is not a remote unauthenticated attack — it requires some level of platform access.

2. User Interaction: The disclosure occurs when the affected action is invoked. The exposure is observed by whoever can view the user interface of the Splunk SOAR instance, which typically includes other platform users.

3. Network Attack Vector: The CVSS vector indicates AV:N (Network), meaning the Splunk SOAR instance is reachable over the network. The low attack complexity (AC:L) suggests the action invocation requires no special conditions beyond valid privileges.

4. Low Confidentiality Impact: The CVSS confidentiality score is L (Low). The exposed data is the Webex meeting password itself — a credential that grants access to a specific meeting. This is not the application's master credentials or a broader authentication mechanism, hence the limited severity rating.

5. No Integrity or Availability Impact: The vector explicitly shows I:N (None) and A:N (None), confirming this is purely a confidentiality issue with no data modification or denial-of-service potential.

The vulnerability class is CWE-312: Cleartext Storage of Sensitive Information. In this instance, the sensitive information (meeting password) is not stored insecurely on disk but is displayed in cleartext in the user interface due to a failure to apply the password masking mechanism at the parameter definition level.

It is important to note that the NVD description does not disclose the specific parameter name, the exact action definition structure, or the underlying code implementation of the app. Therefore, the analysis above is limited to what can be derived from the description: the vulnerable parameter exists within the schedule meeting action, and the fix involves marking that parameter as a password type in the app's configuration.

Exploitation Scenarios

No public proof-of-concept or exploit code exists for CVE-2026-76379, and the vulnerability has not been observed in the wild. The attack chain described below is inferred from the vulnerability class and the NVD description rather than from observed exploitation.

Step 1 — Reconnaissance/Target Identification: An attacker begins by identifying Splunk SOAR instances that have the Cisco Webex app installed. This can be accomplished by scanning for exposed Splunk SOAR web interfaces (typically on ports 80/443 for the management console) using network scanning tools or search engines such as Shodan using queries like http.title:"Splunk SOAR". The attacker would also need to identify the presence of the vulnerable Cisco Webex app version — this might be inferred from platform version banners or by attempting to invoke known actions.

Step 2 — Triggering the Flaw: The attacker must obtain a valid Splunk SOAR account with a role that grants permission to run actions. This could be a legitimate user account obtained through social engineering, credential theft, or an existing insider threat position. Once authenticated, the attacker navigates to the area of the Splunk SOAR UI where actions can be executed and locates the schedule meeting action provided by the Cisco Webex app.

Step 3 — Execution Method: The attacker invokes the schedule meeting action. Because the meeting password parameter is not marked as a password field in the app's definition, the value entered for this parameter is displayed in cleartext in the user interface rather than being masked with asterisks. The disclosure occurs passively during the normal operation of the action — no malicious payload is required, and no special exploit technique is needed beyond legitimate interaction with the platform.

Step 4 — Post-Exploitation Impact: Once the meeting password is visible in cleartext, any user who can view the Splunk SOAR interface (including other authenticated users, or attackers who can observe the screen via screen-sharing, surveillance, or session hijacking) can capture the Webex meeting password. This credential can then be used to join scheduled Webex meetings without authorization, potentially exposing confidential meeting content to unauthorized parties. The impact may extend to any recurring meetings where the same password is reused, amplifying the scope of the disclosure.

The exploitability of this vulnerability is inherently limited by the requirement for valid platform credentials and the passive nature of the disclosure. However, in environments where multiple users have action-run permissions or where the Splunk SOAR interface is shared or monitored (such as in a screen-sharing session or office environment), the realistic attack surface increases.

Impact Assessment

The business impact of CVE-2026-76379 centers on confidentiality degradation within the Splunk SOAR operational environment. The CVSS score of 4.3 (Medium) reflects the following sub-characteristics:

• Attack Vector (AV:N — Network): The Splunk SOAR instance can be reached over the network, meaning the vulnerability is not restricted to local-only access.
• Attack Complexity (AC:L — Low): No special conditions or race conditions are required; the flaw triggers during routine action invocation.
• Privileges Required (PR:L — Low): An attacker needs only a low-privileged account with action-run permissions, not administrative access.
• User Interaction (UI:N — None): No victim interaction beyond the attacker's own invocation of the action is necessary.
• Confidentiality Impact (C:L — Low): Only the meeting password is exposed; no broader data compromise occurs.
• Integrity (I:N) and Availability (A:N): Neither data integrity nor service availability is affected.

The affected systems are Splunk SOAR deployments (both on-premises and hosted variants) running the Cisco Webex app at versions below 2.2.1. The blast radius is limited to organizations that use Webex meetings as part of their SOAR workflows and integrate the app to manage meeting scheduling.

Realistic impact scenarios include: (1) unauthorized access to confidential Webex meetings containing sensitive business discussions or incident-response teleconferences; (2) loss of trust in the SOAR platform's security posture among internal stakeholders; and (3) potential secondary impacts if meeting passwords are reused across meetings or if meeting content includes regulated data (PII, PHI, PCI). For organizations in regulated industries (healthcare, finance, government), an information disclosure of this nature may trigger compliance review obligations.

Detection Guidance

Detection of this vulnerability is challenging because it is not an active exploitation vector — it is a passive disclosure that occurs during legitimate action invocation. The same action invocation that triggers the vulnerability is a normal, authorized operation. Therefore, detection must focus on: (a) identifying users who repeatedly invoke the schedule meeting action, (b) monitoring for abnormal access to the SOAR UI that might indicate an unauthorized user viewing exposed passwords, and (c) correlating subsequent unauthorized Webex meeting joins with users who had access to the SOAR platform.

The following detection rules are tailored for environments where the Splunk SOAR UI and its backend logs are collected into a central SIEM or detection platform. Adjust field names and log sources to match your specific deployment.

Sigma Rule

title: Cisco Webex App for Splunk SOAR - Schedule Meeting Action Invoked
id: 7f3a9c2e-5b4d-4f8a-9c1e-8d5b7a0e3f2c
status: experimental
description: Detects invocation of the schedule meeting action in Splunk SOAR that may lead to cleartext exposure of Webex meeting passwords (CVE-2026-76379).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-76379
author: ValtersIT Threat Intelligence Team
date: 2026/07/15
logsource:
    product: splunk
    service: soar
detection:
    selection:
        action_name: "schedule meeting"
        app_name: "webex"
    condition: selection
level: medium
fields:
    - user
    - src_ip
    - action_name
    - app_name
    - outcome
falsepositives:
    - Legitimate scheduled meetings by authorized SOAR users
tags:
    - attack.t1204
    - cve.2026-76379
    - cwe.312

YARA Rule

rule CVE_2026_76379_Webex_SOAR_Password_Exposure
{
    meta:
        author = "ValtersIT Threat Intelligence Team"
        description = "Detects patterns in Splunk SOAR logs indicating invocation of Cisco Webex schedule meeting action with potential cleartext password exposure (CVE-2026-76379)"
        date = "2026-07-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76379"
        cve = "CVE-2026-76379"
        severity = "medium"
    strings:
        $s1 = "schedule_meeting" ascii wide nocase
        $s2 = "webex" ascii wide nocase
        $s3 = "meeting_password" ascii wide nocase
        $s4 = "action_run" ascii wide nocase
        $s5 = "action_result" ascii wide nocase
    condition:
        2 of ($s*) and any of ($s*)
}

Suricata IDS Rule

alert tcp any any -> $HOME_NET any (msg:"CVE-2026-76379 - Cisco Webex App for Splunk SOAR Schedule Meeting Action Invocation with Potential Password Exposure"; flow:established,to_server; content:"schedule_meeting"; http_uri; content:"webex"; http_uri; content:"action"; http_uri; classtype:attempted-user; sid:2026076301; rev:1; metadata:created_at 2026-07-15, updated_at 2026-07-15, cve CVE-2026-76379, cwe CWE-312, tag webex, tag soar;)

Elastic Detection

sequence by user.name with maxspan=5m
  [authentication where user.name != null and event.outcome == "success"]
  [any where user.name != null and (event.provider == "splunk_soar" or event.module == "splunk_soar") filter where (message : "*schedule meeting*" and message : "*webex*" and message : "*action*")]

Splunk SPL Query

index="soar" sourcetype="soar:action" 
| where action_name="schedule meeting" AND app_name="webex" 
| table _time, user, src_ip, action_name, app_name, status, outcome 
| sort -_time 
| stats count by user, src_ip

Wazuh OSSEC Rule

<group name="webex_soar,">
    <rule id="628783" level="8">
        <decoded_as>json</decoded_as>
        <field name="action_name">schedule meeting</field>
        <field name="app_name">webex</field>
        <description>CVE-2026-76379: Cisco Webex app for Splunk SOAR - schedule meeting action invoked. Potential cleartext password exposure.</description>
        <group>webex,soar,cve-2026-76379,</group>
        <mitre>
            <id>T1204</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

The vendor has not yet released a confirmed patch, and no official version containing the fix has been verified from the tracked sources. However, the NVD description references version 2.2.1 as the version above which the vulnerability is resolved, indicating that the vendor has acknowledged the issue and version 2.2.1 (or later) is the target for remediation.

1) Immediate Mitigations (until patch is available):

• Restrict action-run permissions: Review role definitions in Splunk SOAR and limit the run action permission to only users who absolutely require it. The vulnerability requires this permission, so reducing the population of users with that role directly reduces exposure.
• Monitor action invocation logs: Implement the SIEM detection rules above to identify all invocations of the schedule meeting action and audit them for legitimacy.
• Avoid using meeting passwords in the schedule meeting action: If the workflow allows, configure Webex meetings without passwords or enter a placeholder value and configure the actual meeting separately, to prevent exposure.
• Limit UI access: Restrict who has access to the Splunk SOAR web interface and enforce strict session management to reduce the chance of shoulder-surfing.
• Use screen privacy filters on thin-client monitors or workstations where SOC analysts access the Splunk SOAR interface.
• Review prior action logs: Audit historical action runs of the schedule meeting action to identify any past exposures that may already have been observed by unauthorized personnel.

2) Patch/Upgrade Steps:

• Upgrade the Cisco Webex app for Splunk SOAR to version 2.2.1 or later as soon as the vendor makes it available. Monitor Cisco's official security advisory page and the Splunk SOAR app marketplace for the update.
• Before upgrading, review the app's release notes to confirm the fix marks the meeting password parameter with the password type attribute.
• After upgrading, regression-test the schedule meeting action to confirm the password parameter is masked in the UI.

3) Long-Term Hardening:

• Adopt a least-privilege model for all Splunk SOAR roles; action-run permissions should be the exception, not the default.
• Implement session recording and monitoring for the Splunk SOAR UI to detect and deter credential exposure incidents.
• Consider integrating a DLP (Data Loss Prevention) layer that detects cleartext credentials in UI content if such technology is available for the SOAR platform.
• Develop and maintain an asset inventory of all Splunk SOAR app integrations to ensure patch coverage is complete and verified.
• Integrate CVE-2026-76379 into your vulnerability management lifecycle and track it until verified patched across all environments.

References

1. NVD Entry: NIST National Vulnerability Database — CVE-2026-76379. Available at: https://nvd.nist.gov/vuln/detail/CVE-2026-76379 (Accessed July 2026). Official record containing the description, CVSS vector, and CWE classification.

2. Splunk SOAR Documentation — Run an Action: Splunk Help Center. "Run an action in Splunk SOAR." Available at: https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises (Accessed July 2026). This is the vendor-provided reference document cited in the NVD description, describing the action-execution workflow in Splunk SOAR that is affected by this vulnerability.

3. CWE-312 — Cleartext Storage of Sensitive Information: MITRE Common Weakness Enumeration. Available at: https://cwe.mitre.org/data/definitions/312.html (Accessed July 2026). Classification reference for the vulnerability class.

4. Cisco Webex for Splunk SOAR App: Official Cisco Webex app listing for the Splunk SOAR marketplace. Verify the latest version availability and release notes by checking the Splunk SOAR app catalog and Cisco's advisory announcements.

5. CISA Known Exploited Vulnerabilities Catalog: Currently, CVE-2026-76379 is NOT listed in the CISA KEV catalog, indicating no known exploitation in the wild at the time of reporting. Monitor the catalog for updates: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity:

As of the writing of this report, there is no evidence of active exploitation of CVE-2026-76379 in the wild. No threat actor campaigns, exploit kits, or malware signatures have been observed referencing this CVE. The vulnerability remains unpatched with no public proof-of-concept, and it has not been added to the CISA KEV catalog. This may change as the vulnerability becomes more widely known within the security research community.