CVE-2026-76393 Race Condition during Model Upload through the REST API in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.0, a user who can upload models could overwrite a model being uploaded by another user by sending a concurrent upload request for the same model name, causing the resulting model lookup entry to reference attacker-controlled content. The race condition is...

CVE-2026-76390 Information Disclosure through Splunk Web in Cisco Talos Intelligence for Enterprise Security Cloud

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer REST A...

CVE-2026-76391 Improper Privilege Management through Agent Run History in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could run searches with system-level privileges, access all relevant data, affect system integrity, and read or delete search jobs belonging to other users through Agent Run History. The improp...

CVE-2026-76391

In Splunk AI Toolkit versions below 6.0.0, the Agent Run History handler swaps the caller's session key for a system token, allowing low-privilege users to run system-level searches, access all data, and read or delete other users' search jobs. CVSS 3.1 scores 8.3 (HIGH). No exploitation evidence...

CVE-2026-76391 Improper Privilege Management through Agent Run History in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could run searches with system-level privileges, access all relevant data, affect system integrity, and read or delete search jobs belonging to other users through Agent Run History. The improp...

CVE-2026-76390

Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3 expose the add-on's OpenAPI specification through Splunk Web static file paths without requiring authentication. The root cause is that the generated OpenAPI spec is packaged in a static file path that Splunk Web serves u...

CVE-2026-76390 Information Disclosure through Splunk Web in Cisco Talos Intelligence for Enterprise Security Cloud

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer REST A...

CVE-2026-76389 Server-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intelligence for Enterprise Security Cloud

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a role with the gettalosenrichment capability could send a crafted request to the Talos intelligence enrichment Representational State Transfer REST API endpoint and cause the instance to make an...

CVE-2026-76389 Server-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intelligence for Enterprise Security Cloud

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a role with the gettalosenrichment capability could send a crafted request to the Talos intelligence enrichment Representational State Transfer REST API endpoint and cause the instance to make an...

CVE-2026-76389

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, the Talos enrichment REST endpoint accepts the destination for authenticated Splunk management requests from request data, enabling an SSRF attack. A user with the get_talos_enrichment capability can force the instanc...

CVE-2026-76387 SPL Injection through the REST API in Splunk Enterprise Security

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mcinvestigationread capability could inject Search Processing Language SPL through Analyst Queue search filters, allowing for access to all relevant data and system integrity...

CVE-2026-76388

A low-privilege user with the ess_analyst role can modify UEBA search macros that run with admin privileges. Root cause: UEBA app metadata grants analyst roles write access to macros that should be admin-only. Impact: HIGH confidentiality and integrity exposure (CVSS 8.1). Affected: Splunk Enterp...

CVE-2026-76387 SPL Injection through the REST API in Splunk Enterprise Security

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mcinvestigationread capability could inject Search Processing Language SPL through Analyst Queue search filters, allowing for access to all relevant data and system integrity...

CVE-2026-76388 Privilege Escalation through Search Macro Permissions in Splunk Enterprise Security

In Splunk Enterprise Security versions below 8.6.1, a user who holds the essanalyst Splunk Enterprise Security role could change User and Entity Behavior Analytics UEBA search macros that scheduled searches run with administrator permissions, allowing for access to all relevant data and system...

CVE-2026-76387

In Splunk Enterprise Security versions below 8.6.1, the Analyst Queue search filter handling does not validate filter field names before inclusion in SPL searches. A user with the mc_investigation_read capability can inject SPL, gaining access to all data and system integrity available to their s...

CVE-2026-76388 Privilege Escalation through Search Macro Permissions in Splunk Enterprise Security

In Splunk Enterprise Security versions below 8.6.1, a user who holds the essanalyst Splunk Enterprise Security role could change User and Entity Behavior Analytics UEBA search macros that scheduled searches run with administrator permissions, allowing for access to all relevant data and system...

CVE-2026-76385 Information Disclosure through Action Parameters in Venafi app for Splunk SOAR

In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwords by invoking the get certificate action, because the action's keystorepassword and password parameters are not masked and are shown in...

CVE-2026-76386 Information Disclosure through Action Parameters in Zoom app for Splunk SOAR

In versions below 3.2.2 of the Zoom app for Splunk SOAR, a user who holds a role with permission to run actions could expose meeting and personal meeting ID passwords by invoking one of the create meeting, update meeting, or update user settings actions, because the affected password and...

CVE-2026-76385 Information Disclosure through Action Parameters in Venafi app for Splunk SOAR

In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwords by invoking the get certificate action, because the action's keystorepassword and password parameters are not masked and are shown in...

CVE-2026-76386

In Zoom app for Splunk SOAR versions below 3.2.2, the "password" and "pmi_password" action parameters are not masked, causing cleartext exposure of Zoom meeting passwords and personal meeting ID passwords in the UI when a user with action-running privileges invokes create/update meeting or update...