{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-76390","assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","state":"PUBLISHED","assignerShortName":"cisco","dateReserved":"2026-08-19T12:02:03.631Z","datePublished":"2026-08-19T21:35:09.175Z","dateUpdated":"2026-08-20T16:27:30.600Z"},"containers":{"cna":{"affected":[{"product":"Cisco Talos Intelligence for Enterprise Security Cloud","vendor":"Splunk","versions":[{"version":"1.0","status":"affected","versionType":"custom","lessThan":"1.0.3"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/markdown","value":"In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer (REST) API endpoints and authentication model. The vulnerability is possible because the generated OpenAPI specification is packaged in a static file path that Splunk Web serves without authentication. For more information see [Deploy Cisco Talos Intelligence for Splunk Enterprise Security](https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/introduction/deploy-cisco-talos-intelligence-for-splunk-enterprise-security-cloud-only) in the Splunk documentation."}],"value":"In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer (REST) API endpoints and authentication model. The vulnerability is possible because the generated OpenAPI specification is packaged in a static file path that Splunk Web serves without authentication. For more information see Deploy Cisco Talos Intelligence for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/introduction/deploy-cisco-talos-intelligence-for-splunk-enterprise-security-cloud-only) in the Splunk documentation."}],"references":[{"url":"https://advisory.splunk.com/advisories/SVD-2026-0808"}],"title":"Information Disclosure through Splunk Web in Cisco Talos Intelligence for Enterprise Security Cloud","datePublic":"2026-08-19T00:00:00.000Z","metrics":[{"cvssV3_1":{"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1","baseScore":5.3,"baseSeverity":"MEDIUM"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"cwe","cweId":"CWE-200","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."}]}],"source":{"advisory":"SVD-2026-0808"},"providerMetadata":{"orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco","dateUpdated":"2026-08-19T21:35:09.175Z"},"solutions":[{"lang":"en","value":"Upgrade each affected Splunk app or add-on to the applicable fixed version listed in Product Status."}],"workarounds":[{"lang":"en","value":"Turn off or remove the Cisco Talos Intelligence for Enterprise Security Cloud app. For more information see [Manage app and add-on objects](https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/meet-splunk-apps/manage-app-and-add-on-objects) in the Splunk documentation."}],"credits":[{"lang":"en","value":"Gabriel Nitu, Splunk","type":"reporter"}]},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-76390","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-20T16:07:34.623272Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-20T16:27:30.600Z"}}]}}