CVE-2026-76386

Executive Summary

CVE-2026-76386 is an information disclosure vulnerability in the Zoom app for Splunk SOAR, affecting all versions prior to 3.2.2. A user with a role that includes permission to run actions can expose meeting passwords and personal meeting ID (PMI) passwords when invoking the create meeting, update meeting, or update user settings actions, because the affected parameters (password and pmi_password) are not marked as passwords and are displayed in cleartext in the user interface. The vulnerability stems from the app failing to annotate these action parameters with the appropriate password metadata, which would otherwise trigger masking in the Splunk SOAR UI. With a CVSS score of 4.3 and a low attack complexity, this flaw targets the confidentiality of sensitive meeting credentials for organizations using both Zoom and Splunk SOAR in their security operations workflows. No public exploit code is available, and the patch is included in version 3.2.2.

Technical Analysis

The vulnerability class is CWE-312 — Cleartext Storage of Sensitive Information. In the context of Splunk SOAR's action framework, every action parameter can be optionally designated as a password-type parameter. When an action parameter is marked as a password, the Splunk SOAR platform automatically masks the value in the user interface, logs, and audit trails. The Zoom app for Splunk SOAR fails to apply this password designation to the password parameter used by the create meeting and update meeting actions, and to the pmi_password parameter used by the update user settings action. As a result, these sensitive values are rendered as plaintext in the Splunk SOAR UI when the action is run.

Attack Surface: The attack surface is the Splunk SOAR web interface. A user who already holds a role with the "run action" permission is the prerequisite actor. This is an internal-threat or low-privilege-leveraging scenario — not a remote unauthenticated attack. The attacker must be an authenticated user of the Splunk SOAR platform with the ability to invoke actions. The flaw is in the UI rendering layer and possibly audit/log output.

Mechanism Detail: In Splunk SOAR's action framework, parameters are defined in the app's JSON configuration file (app manifest), where each parameter can have a contains attribute or be explicitly typed. When a parameter contains sensitive data, the app developer must set the appropriate contains value or use a "password" type to trigger masking. The Zoom app's manifest either omits this metadata or sets the parameter type to a non-secret type (e.g., string). Consequently, the Splunk SOAR UI displays the actual value of password and pmi_password in cleartext within the action run results and any subsequent playbook execution records.

Data Flow: The user navigates to the Splunk SOAR UI → selects the Zoom app → chooses the affected action (e.g., "create meeting") → enters a meeting password or the system retrieves a stored configuration value → the action executes → the response output renders in the UI showing the cleartext password value. This is a static display issue, not an interception or network-based exposure. However, the same cleartext may also persist in the action output history, potentially accessible to other users with read access to action results.

Code-Level Context: Without direct access to the app source code, the specific manifest fields cannot be detailed. However, the NVD description confirms that "the app does not mark the affected action parameters as passwords" — this is the root cause. The fix involves updating the app manifest to include password type designations for the affected parameters and releasing it as version 3.2.2.

Exploitation Scenarios

Prerequisite Assumptions: The attacker is an authenticated Splunk SOAR user (or has compromised such an account) holding a role with the run action permission. The target organization uses the Zoom app (version < 3.2.2) in their SOAR deployment. The affected actions (create meeting, update meeting, update user settings) must be available in the app.

Attack Chain:

1. Reconnaissance/Target Identification: The attacker identifies a Splunk SOAR instance (e.g., via internal network scanning or by obtaining valid credentials through phishing). The attacker enumerates the available apps and their actions within the SOAR UI. They identify the Zoom app and its exposed actions.

2. Triggering the Flaw: The attacker logs into Splunk SOAR and navigates to the Zoom app action list. They invoke either the create meeting or update meeting action with a known meeting password (or create a new meeting with a self-chosen password), or they invoke update user settings with a pmi_password value. The attacker does not need to know the target's existing password to trigger the flaw — they can create a new meeting with a known password and observe that the password is displayed in cleartext. However, in a realistic scenario, the attacker would use a stored configuration value (e.g., a password from the SOAR vault or an environment variable) to see if the system reveals a pre-existing secret.

3. Execution: The action executes against the Zoom API. Upon completion, Splunk SOAR renders the action result in the UI. The response includes the password (for meeting actions) or pmi_password (for settings update) fields, which are displayed unmasked. The attacker reads the cleartext value from the action output pane. Because the parameters are not typed as passwords, the platform does not apply its masking/regex redaction to the returned values.

4. Post-Exploitation Impact: The attacker now possesses valid meeting passwords or the PMI password for the organization's Zoom account. These credentials can be used to join scheduled meetings without authorization, potentially accessing confidential business discussions. If the pmi_password is the account-level PMI password, the attacker gains persistent unauthorized access to the organization's personal meeting room. In the worst case, if the password is reused across other services (a common poor practice), the attacker may attempt credential stuffing against other internal systems.

Note on Attack Limitations: This is not a remote code execution or data exfiltration vulnerability. The attacker cannot use this flaw to escalate privileges within Splunk SOAR itself — they require the run action permission as a baseline. The CVSS vector confirms this: PR:L (low privileges required) and C:L (low confidentiality impact). No public PoC or exploit-in-the-wild activity is known.

Impact Assessment

Business Impact: The primary impact is the compromise of meeting credentials for organizations operating a security automation platform. These credentials protect potentially sensitive strategy meetings, incident response bridge calls, and executive communications. Exposure of the PMI password is particularly damaging because the personal meeting ID is often used as a persistent virtual meeting room. An attacker with the PMI password can join any meeting hosted in that personal room without an invitation.

Affected Systems: Splunk SOAR deployments (on-premises or cloud) with the Zoom app installed at version < 3.2.2. The vulnerability exists in the app's configuration, not in the Splunk SOAR core platform, so all deployments using the affected app version are vulnerable.

CVSS Subscore Analysis: The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N breaks down as: Network attack vector (the SOAR UI is accessible over the network), low attack complexity (no special conditions), low privileges required (any user with run-action permission — which is often granted broadly in SOC environments), no user interaction, unchanged scope (confidentiality impact is limited to the affected component), low confidentiality impact (single secret category), no integrity impact, no availability impact. The score of 4.3 places this in the "Medium" severity band (MEDIUM on the NVD scale).

Blast Radius: The blast radius is limited to the confidentiality of Zoom meeting credentials. If an attacker exfiltrates the password for a specific meeting, the impact is time-bound to that meeting's duration. If the pmi_password is exposed, the impact is persistent. In multi-tenant SOAR environments where multiple teams share the Zoom app configuration, a single leaked credential could affect multiple business units. The absence of integrity/availability impact limits the severity, but the sensitive nature of meeting passwords (which can contain intellectual property discussions) elevates the real-world risk.

Why the CVSS is 4.3 (not higher): The requirement for an authenticated account with action privileges removes the unauthenticated attacker scenario. The confidentiality impact is "low" because only passwords are exposed (not encryption keys, database credentials, or bulk PII), and the data is meeting-specific rather than platform-wide.

Detection Guidance

Detection for this vulnerability is challenging because the flaw manifests in the UI rendering layer, not in network traffic or typical log events. The exploitation action (invoking create meeting, update meeting, or update user settings) is a legitimate operation in the SOAR platform. Detection must therefore focus on behavioral anomalies: unusual patterns of action invocation, abnormal access to action output data, or unexpected use of the Zoom app by non-bridge-owner accounts.

Sigma Rule

title: Suspicious Zoom App Action Invocation in Splunk SOAR
id: 5f2ae4e8-3b12-4c7d-9f41-72cf4a3b96d2
status: experimental
description: Detects repeated invocation of Zoom app actions (create meeting, update meeting, update user settings) by accounts that do not typically manage meetings, which may indicate an attempt to exploit CVE-2026-76386 password disclosure.
logsource:
    product: splunk
    service: soar
detection:
    selection_action:
        action_name:
            - 'zoom_create_meeting'
            - 'zoom_update_meeting'
            - 'zoom_update_user_settings'
    selection_timeframe:
        # Any timeframe; this rule is designed to catch volume anomalies
        # Correlate in SIEM with user-based baseline
    condition: selection_action
    timeframe: 1h
level: medium
falsepositives:
    - Legitimate meeting scheduling by SOC bridge operators
    - Automated playbooks that create Zoom meetings on demand
tags:
    - attack.t1005
    - cve.2026.76386
    - cwe.312

YARA Rule

rule CVE_2026_76386_Zoom_SOAR_Password_Exposure
{
    meta:
        author = "ValterSIT Threat Intel"
        description = "Detects uncompiled Zoom app manifest files or configuration artifacts that lack password type markers for meeting credentials (CVE-2026-76386)"
        cve = "CVE-2026-76386"
        date = "2026-05-01"
    strings:
        $s1 = "create_meeting" nocase
        $s2 = "update_meeting" nocase
        $s3 = "update_user_settings" nocase
        $s4 = "pmi_password" nocase
        $s5 = "password" nocase
        $s6 = "\"contains\"" nocase
    condition:
        uint32(0) == 0x5A4F4F4D or  // 'ZOOM' magic for custom app bundles
        (filesize < 2MB and
         (($s1 or $s2) and $s4) and
         # "contains" marker absence is structural - check if $s5 NOT adjacent to $s6
         not ($s5 and $s6 within 20 bytes))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-76386 - Zoom SOAR action invocation with unmasked password exposure"; flow:established,to_server; content:"POST"; http_method; content:"/rest/action/"; http_uri; content:"zoom"; http_uri; content:"create_meeting"; http_uri; sid:2026763861; rev:1; metadata:cve CVE-2026-76386; reference:url,https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises;)

Note: This rule detects the network-level invocation of the affected actions. Given the vulnerability is in UI rendering, network detection is limited to observing the action request patterns. This rule targets the SOAR REST API path pattern for action invocation.

Elastic Detection

// Detect excessive or unusual Zoom meeting-related action usage in SOAR audit logs
sequence by user.name with maxspan=1h
  [any where event.category == "authentication" and event.outcome == "success"]
  [any where audit.action == "run_action" and audit.action_object == "zoom" 
   and audit.action_parameters in ("create_meeting", "update_meeting", "update_user_settings")]
  | event.duration > 0.5s // imply non-cached action execution

Splunk SPL Query

index=soar sourcetype=soar:audit action=run_action
| where like(lower(action_name), "%zoom%") 
| search action_name IN ("create_meeting", "update_meeting", "update_user_settings")
| stats count by user, action_name, dest, container
| where count > 5
| table _time, user, action_name, dest, container, count
| sort - count

Wazuh OSSEC Rule

<group name="splunk_soar,">
  <rule id="649733" level="10">
    <decoded_as>json</decoded_as>
    <field name="type">^soar_audit$</field>
    <field name="action">^run_action$</field>
    <field name="app">^zoom$</field>
    <regex>action_name=(create_meeting|update_meeting|update_user_settings)</regex>
    <description>CVE-2026-76386 - Zoom SOAR action invoked, potential password exposure event</description>
    <group>cve_2026_76386,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: Patch confidence is 0/4 (UNPATCHED from the perspective of available patch evidence in tracked sources), but the vendor has released version 3.2.2, which is the applicable patched version. This discrepancy means no CVE-specific patch advisory has been published in tracked feeds, but the vendor shipped a version fix.

1. Immediate Mitigations (until upgrade is complete):

• Restrict the run action permission to only the minimal set of users who require it for Zoom meeting management. Review SOAR RBAC policies and remove this permission from junior analysts or read-only roles.
• Disable the Zoom app's update_user_settings action if the organization does not routinely need to change PMI settings programmatically.
• Disable the Zoom app entirely if it is not actively used — remove it from the SOAR platform.
• Review audit logs for any users who invoked create meeting, update meeting, or update user settings actions since the app was installed; if you have concerns, rotate all Zoom meeting passwords and the PMI password.

2. Patch/Upgrade Steps:

• Upgrade the Zoom app for Splunk SOAR to version 3.2.2 from the Splunk SOAR app marketplace or the internal app package repository.
• After upgrading, verify that the create meeting and update meeting actions now mask the password parameter, and that update user settings masks pmi_password. Test by running a dummy action and confirming the UI renders ****** instead of cleartext values.
• If a manual patch is required (e.g., for air-gapped environments), edit the app's manifest JSON to add "contains": ["password"] or the appropriate "type": "password" attribute to the affected parameters, then re-import the app.

3. Long-Term Hardening:

• Establish a policy that all Splunk SOAR app code review must verify that any parameter containing secrets (passwords, API keys, tokens) is explicitly typed as a password in the app manifest. Add this to the development lifecycle checklist.
• Implement credential rotation for Zoom meeting passwords and PMI passwords on a recurring schedule (e.g., quarterly) to limit the window of exposure if a password is leaked.
• Monitor the Splunk SOAR UI access logs for anomalous output-viewing patterns — specifically, users with run action permissions who are not part of the incident response team viewing Zoom action results.
• Enable strict audit logging on the SOAR platform and forward action execution logs to the central SIEM.
• Ensure the principle of least privilege is enforced: separate the role that grants "run action" from the role that grants broader SOAR administrative access, so that a compromised low-privilege account cannot reach this vulnerability.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-76386
2. Splunk SOAR Documentation — Run an Action: https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises
3. Zoom Apps for Splunk SOAR (vendor advisory — version 3.2.2 release notes): https://marketplace.splunk.com/apps/zoom (or the Zoom app page in Splunk SOAR app repository)
4. CWE-312 — Cleartext Storage of Sensitive Information: https://cwe.mitre.org/data/definitions/312.html

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No known threat actor campaigns or exploit-in-the-wild activity is associated with CVE-2026-76386 as of the report date. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No public exploit code has been published, and no Nuclei template exists for this vulnerability. The attack surface requires pre-existing authenticated access, which reduces the likelihood of mass exploitation.