CVE-2026-76389Server-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intelligence for Enterprise Security Cloud
Updated under an hour ago ()
Does this affect you?
It affects Splunk Cisco Talos Intelligence for Enterprise Security Cloud and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a role with the get_talos_enrichment capability could send a crafted request to the Talos intelligence enrichment Representational State Transfer (REST) API endpoint and cause the instance to make an outbound request to an attacker-controlled server. The request could expose tokens that compromise all relevant data and system integrity in the Splunk instance. The vulnerability is possible because the Talos intelligence enrichment REST endpoint accepts the destination for authenticated Splunk management requests from request data. For more information see Deploy Cisco Talos Intelligence for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/introduction/deploy-cisco-talos-intelligence-for-splunk-enterprise-security-cloud-only) in the Splunk documentation.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-918
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- cisco
- NVD analysis
- Analyzed
- Record last updated
- Aug 20, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Splunk Cisco Talos Intelligence for Enterprise Security Cloud splunk:cisco_talos_intelligence_for_enterprise_security_cloud (from the name) | from 1.0 before 1.0.3 | CNA record |
cisco talos_intelligence_for_enterprise_security_cloud cisco:talos_intelligence_for_enterprise_security_cloud | from 1.0.0 before 1.0.3 | NVD |
References
- https://advisory.splunk.com/advisories/SVD-2026-0808vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.