CVE-2026-76389

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a role with the get_talos_enrichment capability could send a crafted request to the Talos intelligence enrichment Representational State Transfer (REST) API endpoint and cause the instance to make an outbound request to an attacker-controlled server. The request could expose tokens that compromise all relevant data and system integrity in the Splunk instance. The vulnerability is possible because the Talos intelligence enrichment REST endpoint accepts the destination for authenticated Splunk management requests from request data. For more information see Deploy Cisco Talos Intelligence for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/introduction/deploy-cisco-talos-intelligence-for-splunk-enterprise-security-cloud-only) in the Splunk documentation.

• CWE-918

• https://advisory.splunk.com/advisories/SVD-2026-0808Vendor Advisory

Published

Aug 19, 2026

Last Modified

Aug 21, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76383In versions below 1.0.5 of the RSA SecurID Authentication Ma…4.3
• CVE-2026-76384In versions below 2.2.1 of the Splunk Attack Analyzer Connec…4.3
• CVE-2026-76385In versions below 2.1.4 of the Venafi app for Splunk SOAR, a…4.3
• CVE-2026-76386In versions below 3.2.2 of the Zoom app for Splunk SOAR, a u…4.3
• CVE-2026-76387In Splunk Enterprise Security versions below 8.6.1, a user w…8.1
• CVE-2026-76388In Splunk Enterprise Security versions below 8.6.1, a user w…8.1
• CVE-2026-7639Software installed and run as a non-privileged user may cond…7.8
• CVE-2026-76390In Cisco Talos Intelligence for Enterprise Security Cloud ve…5.3
• CVE-2026-76391In Splunk AI Toolkit versions below 6.0.0, a user who does n…8.3
• CVE-2026-76392In Splunk AI Toolkit versions below 6.0.0, a user who does n…5.4
• CVE-2026-76393In Splunk AI Toolkit versions below 6.0.0, a user who can up…5.9
• CVE-2026-76394In Splunk AI Toolkit versions below 6.0.0, a low-privileged …8.3