Splunk FireAMP vulnerabilities

Latest Splunk FireAMP CVEs

Newest publication first

1. CVE-2026-76371 Incorrect Permission Assignment through Safe Mode in FireAMP for Splunk SOAR

   Published 2026-08-19

   Low·CVSS 2.7 EPSS 0.28%

   In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to file lists. The vulne...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.