CVE-2026-76389

Name of the Vulnerable Software and Affected Versions Cisco Talos Intelligence for Enterprise Security Cloud versions prior to 1.0.3

Description A user with the get talos enrichment capability can send a crafted request to the Talos intelligence enrichment REST API endpoint, forcing the instance to make an outbound request to an attacker-controlled server. This occurs because the endpoint accepts the destination for authenticated Splunk management requests directly from the request data. Such an action could expose tokens, compromising system integrity and all relevant data within the Splunk instance.

Recommendations Update to version 1.0.3 or later.