ReviewHigh

CVE-2026-76389

Splunk Cisco Talos Intelligence for Enterprise Security Cloud, talos intelligence for enterprise security cloud

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a role with the get_talos_enrichment capability could send a crafted request to the Talos intelligence enrichment Representational State Transfer (REST) API endpoint and cause the instance to make an outbound request to an attacker-controlled server. The request could expose tokens that compromise all relevant data and system integrity in the Splunk instance. The vulnerability is possible because the Talos intelligence enrichment REST endpoint accepts the destination for authenticated Splunk ma...

CVSS: 8.8
EPSS: -
CISA KEV: Not listed
Published: 2026.08.20

PRIORITY ASSESSMENT

Review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability-

Technical severityCVSS 8.8

Vulnerability overview

Affected product and versions

Product: Splunk Cisco Talos Intelligence for Enterprise Security Cloud, talos intelligence for enterprise security cloud
Affected versions: >= 1.0 < 1.0.3, >= 1.0.0 < 1.0.3
Fixed versions: 1.0.3

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Splunk Cisco Talos Intelligence for Enterprise Security Cloud, talos intelligence for enterprise security cloud and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-918