Cisco Talos Intelligence CVE-2026-76389

Exploitation requires an authenticated Splunk account whose role has been explicitly granted the get_talos_enrichment capability - this is a non-default, purpose-specific permission, not assigned to standard Splunk user or power-user roles. The Cisco Talos Intelligence for Enterprise Security Cloud app must be installed and running a version prior to 1.0.3. The Splunk cloud instance must be able to establish outbound network connections to the attacker-controlled destination server. What limits exploitation: the attacker must already hold valid Splunk credentials with the specific get_talos_enrichment capability, ruling out unauthenticated external attackers; no user interaction or social engineering of a privileged user is required beyond the attacker's own API call.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scores 8.8 and is broadly consistent with the described vulnerability: the attack is network-reachable, low-complexity, and requires only a low-privilege authenticated account with the get_talos_enrichment capability. The C:H/I:H/A:H triple reflects that leaked management tokens effectively grant the attacker full Splunk instance access. However, the PR:L rating deserves scrutiny: exploitation is not possible with a generic Splunk user account - the attacker must hold or compromise a role explicitly granted get_talos_enrichment, which is a non-default, purpose-specific capability. This reduces the realistic attack population compared to a generic PR:L finding. No EPSS score was provided, no CISA KEV listing exists, and no public POC has been identified, suggesting opportunistic mass exploitation is not currently occurring. The highest realistic risk is insider threat or privilege escalation from an already-authenticated low-privilege account. Overall: elevated priority for organizations running Cisco Talos Intelligence for Enterprise Security Cloud, but not broadly critical for the wider market.

An attacker who holds - or has compromised - a Splunk account assigned a role with the get_talos_enrichment capability crafts a REST API request to the Talos intelligence enrichment endpoint, substituting the legitimate Talos destination with an attacker-controlled server. The Splunk instance issues an authenticated outbound management request to that server, delivering Splunk management tokens in the request. The attacker then uses those captured tokens to authenticate directly to the Splunk instance with full management privileges, exfiltrating data or altering configurations.