CVE-2026-76389

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, the Talos enrichment REST endpoint accepts the destination for authenticated Splunk management requests from request data, enabling an SSRF attack. A user with the get_talos_enrichment capability can force the instanc...

CVE-2026-76389 Server-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intelligence for Enterprise Security Cloud

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a role with the gettalosenrichment capability could send a crafted request to the Talos intelligence enrichment Representational State Transfer REST API endpoint and cause the instance to make an...

CVE-2026-76389 Server-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intelligence for Enterprise Security Cloud

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a role with the gettalosenrichment capability could send a crafted request to the Talos intelligence enrichment Representational State Transfer REST API endpoint and cause the instance to make an...

CVE-2026-76387

In Splunk Enterprise Security versions below 8.6.1, the Analyst Queue search filter handling does not validate filter field names before inclusion in SPL searches. A user with the mc_investigation_read capability can inject SPL, gaining access to all data and system integrity available to their s...

CVE-2026-76387 SPL Injection through the REST API in Splunk Enterprise Security

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mcinvestigationread capability could inject Search Processing Language SPL through Analyst Queue search filters, allowing for access to all relevant data and system integrity...

CVE-2026-76387 SPL Injection through the REST API in Splunk Enterprise Security

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mcinvestigationread capability could inject Search Processing Language SPL through Analyst Queue search filters, allowing for access to all relevant data and system integrity...

CVE-2026-76370

In Splunk SOAR versions below 8.6.0 with multi-tenancy enabled, the REST API fails to enforce role-based tenant restrictions, allowing authenticated low-privileged users to enumerate names and IDs of tenants outside their role scope. CVSS 3.1 scores 4.3 (Medium) for confidentiality impact. No exp...

CVE-2026-76370 Information Disclosure through the REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the Representational State Transfer REST API to view the names and identifiers of tenants that fall outside the role scope for that user. The vulnerability is possible because Splunk SOAR does not...

CVE-2026-76370 Information Disclosure through the REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the Representational State Transfer REST API to view the names and identifiers of tenants that fall outside the role scope for that user. The vulnerability is possible because Splunk SOAR does not...

CVE-2026-76366 Information Disclosure through the REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer REST API filtering on playbook runs to recover session tokens that compromise all data available to the affected user. The information disclosure is possible because Splunk SOAR...

CVE-2026-76366

Splunk SOAR versions below 8.6.0 allow authenticated users to exploit REST API filtering on playbook runs to recover session tokens that would otherwise be hidden, enabling compromise of all data accessible to the affected account. CVSS 6.5 (MEDIUM). No in-the-wild exploitation reported. Splunk a...

CVE-2026-76366 Information Disclosure through the REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer REST API filtering on playbook runs to recover session tokens that compromise all data available to the affected user. The information disclosure is possible because Splunk SOAR...

CVE-2026-76362 Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOAR

In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer REST server could access or modify all relevant data exchanged through that credential manager. The vulnerability is...

CVE-2026-76363 Structured Query Language Injection through the REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" role could run arbitrary Structured Query Language SQL statements against the Splunk SOAR database and create, read, update, or delete all data in the database. The vulnerability is possible because Splunk SOAR playbo...

CVE-2026-76362 Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOAR

In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer REST server could access or modify all relevant data exchanged through that credential manager. The vulnerability is...

CVE-2026-76362

Splunk SOAR versions below 8.6.0 fail to verify CyberArk REST server certificates by default, allowing an attacker with network-path interception capability between SOAR and the CyberArk server to read or modify all credential-manager traffic. CVSS 7.4 HIGH (network attack, no auth). Remediation ...

CVE-2026-76363 Structured Query Language Injection through the REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" role could run arbitrary Structured Query Language SQL statements against the Splunk SOAR database and create, read, update, or delete all data in the database. The vulnerability is possible because Splunk SOAR playbo...

CVE-2026-76363

Splunk SOAR versions below 8.6.0 allow an "Automation Engineer" to inject arbitrary SQL via the playbook automation data REST API, enabling full read/write/delete of the database. Splunk advisory SVD-2026-0804 confirms the fix; no in-the-wild exploitation is reported. Upgrade to 8.6.0 or later.

CVE-2026-76361 Server-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../checkconnectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The...

CVE-2026-76361 Server-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../checkconnectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The...