CVE-2026-76389

Received Received - Intake

Privilege Escalation in Cisco Talos Intelligence for Enterprise Security Cloud

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a role with the get_talos_enrichment capability could send a crafted request to the Talos intelligence enrichment Representational State Transfer (REST) API endpoint and cause the instance to make an outbound request to an attacker-controlled server. The request could expose tokens that compromise all relevant data and system integrity in the Splunk instance. The vulnerability is possible because the Talos intelligence enrichment REST endpoint accepts the destination for authenticated Splunk management requests from request data. For more information see Deploy Cisco Talos Intelligence for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/introduction/deploy-cisco-talos-intelligence-for-splunk-enterprise-security-cloud-only) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76389

EUVD

EUVD-2026-62954

Affected Vendors & Products

Vendor	Product	Version / Range
cisco	talos_intelligence_for_enterprise_security_cloud	to 1.0.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3. A user with a role that includes the get_talos_enrichment capability can send a specially crafted request to the Talos intelligence enrichment REST API endpoint. This request causes the system to make an outbound connection to an attacker-controlled server, potentially exposing sensitive tokens that could compromise data integrity and system security in the Splunk instance.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive data, manipulate system configurations, or disrupt services. The exposed tokens could allow full control over the Splunk instance, leading to data breaches, unauthorized modifications, or service disruptions.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating compliance requirements under GDPR, HIPAA, and other regulations. Organizations may face legal penalties, reputational damage, and loss of trust due to data breaches or integrity violations.

Mitigation Strategies

Upgrade Cisco Talos Intelligence for Enterprise Security Cloud to version 1.0.3 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-76389. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70