{"id":"CVE-2026-76390","state":"PUBLISHED","title":"Information Disclosure through Splunk Web in Cisco Talos Intelligence for Enterprise Security Cloud","description":"In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer (REST) API endpoints and authentication model. The vulnerability is possible because the generated OpenAPI specification is packaged in a static file path that Splunk Web serves without authentication. For more information see Deploy Cisco Talos Intelligence for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/introduction/deploy-cisco-talos-intelligence-for-splunk-enterprise-security-cloud-only) in the Splunk documentation.","publishedAt":"2026-08-19T21:35:09.175Z","updatedAt":"2026-08-20T16:27:30.600Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"cisco"},"assigner":"cisco","products":["Splunk Cisco Talos Intelligence for Enterprise Security Cloud"],"affected":[{"vendor":"Splunk","product":"Cisco Talos Intelligence for Enterprise Security Cloud","versions":[{"version":"1.0","status":"affected","lessThan":"1.0.3","versionType":"custom"}]}],"references":["https://advisory.splunk.com/advisories/SVD-2026-0808"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/76xxx/CVE-2026-76390.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-76390","state":"PUBLISHED","datePublished":"2026-08-19T21:35:09.175Z","dateUpdated":"2026-08-20T16:27:30.600Z","assignerShortName":"cisco","assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","dateReserved":"2026-08-19T12:02:03.631Z"},"containers":{"cna":{"title":"Information Disclosure through Splunk Web in Cisco Talos Intelligence for Enterprise Security Cloud","descriptions":[{"lang":"en","value":"In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer (REST) API endpoints and authentication model. The vulnerability is possible because the generated OpenAPI specification is packaged in a static file path that Splunk Web serves without authentication. For more information see Deploy Cisco Talos Intelligence for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/introduction/deploy-cisco-talos-intelligence-for-splunk-enterprise-security-cloud-only) in the Splunk documentation."}],"affected":[{"vendor":"Splunk","product":"Cisco Talos Intelligence for Enterprise Security Cloud","versions":[{"version":"1.0","status":"affected","lessThan":"1.0.3","versionType":"custom"}]}],"references":[{"url":"https://advisory.splunk.com/advisories/SVD-2026-0808"}],"metrics":[{"cvssV3_1":{"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1","baseScore":5.3,"baseSeverity":"MEDIUM"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","lang":"en","type":"cwe","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."}]}],"providerMetadata":{"shortName":"cisco","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","dateUpdated":"2026-08-19T21:35:09.175Z"},"datePublic":"2026-08-19T00:00:00.000Z","source":{"advisory":"SVD-2026-0808"},"solutions":[{"lang":"en","value":"Upgrade each affected Splunk app or add-on to the applicable fixed version listed in Product Status."}],"workarounds":[{"lang":"en","value":"Turn off or remove the Cisco Talos Intelligence for Enterprise Security Cloud app. For more information see [Manage app and add-on objects](https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/meet-splunk-apps/manage-app-and-add-on-objects) in the Splunk documentation."}],"credits":[{"lang":"en","value":"Gabriel Nitu, Splunk","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-76390","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-20T16:07:34.623272Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-20T16:27:30.600Z"}}]}}}