CVE-2026-76390 Overview
CVE-2026-76390 is an information disclosure vulnerability in Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3. An unauthenticated remote attacker can access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification reveals Representational State Transfer (REST) API endpoints and the authentication model used by the add-on, enabling reconnaissance against the deployment. The vulnerability maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated network attackers can enumerate REST API endpoints and authentication models of the Cisco Talos Intelligence add-on, providing reconnaissance data for follow-on attacks.
Affected Products
- Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3
- Splunk Enterprise Security deployments hosting the affected add-on
- Splunk Web static file path handler serving the packaged OpenAPI specification
Discovery Timeline
- 2026-08-19 - CVE-2026-76390 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76390
Vulnerability Analysis
The vulnerability exists in how the Cisco Talos Intelligence add-on packages its generated OpenAPI specification. The specification file is placed in a static file path served by Splunk Web without authentication controls. Any unauthenticated user with network access to Splunk Web can retrieve the specification and enumerate the add-on's REST API surface.
The disclosed OpenAPI document describes REST endpoints, expected parameters, response schemas, and the authentication model used by the add-on. Attackers can use this information to plan targeted attacks against exposed endpoints, identify undocumented functionality, and probe authentication mechanisms. The exposure affects confidentiality only; integrity and availability are not directly impacted.
Root Cause
The root cause is an insecure default configuration where the generated OpenAPI specification is packaged in a Splunk Web static file directory. Splunk Web serves static files without requiring authentication, so the specification becomes reachable through direct URL requests. The add-on did not relocate the specification behind an authenticated route or restrict access via configuration.
Attack Vector
Exploitation requires only network access to the Splunk Web interface hosting the vulnerable add-on. An unauthenticated attacker sends an HTTP GET request to the static file path containing the OpenAPI specification. No user interaction, credentials, or elevated privileges are required. The vulnerability description and remediation guidance are documented in the Splunk Security Advisory SVD-2026-0808.
Detection Methods for CVE-2026-76390
Indicators of Compromise
- Unauthenticated HTTP GET requests to Splunk Web static file paths returning JSON or YAML OpenAPI specification content
- Requests from external or unexpected source IP addresses targeting add-on static asset directories
- Sequential enumeration attempts against REST API endpoints referenced in the exposed OpenAPI document
Detection Strategies
- Review Splunk Web access logs for unauthenticated requests to static file paths associated with the Cisco Talos Intelligence add-on
- Alert on HTTP responses containing OpenAPI markers such as openapi: or swagger: served from add-on static directories
- Correlate reconnaissance-style access patterns with subsequent authenticated API attempts against the same endpoints
Monitoring Recommendations
- Ingest Splunk Web access logs into a centralized analytics platform and baseline expected static file traffic
- Monitor for spikes in requests to add-on static paths from single source IPs indicating enumeration
- Track version inventory of the Cisco Talos Intelligence add-on across deployed Splunk instances to confirm patch coverage
How to Mitigate CVE-2026-76390
Immediate Actions Required
- Upgrade the Cisco Talos Intelligence for Enterprise Security Cloud add-on to version 1.0.3 or later
- Restrict network access to Splunk Web interfaces to trusted management networks only
- Review Splunk Web access logs for prior unauthenticated access to the OpenAPI specification path
Patch Information
Upgrade to Cisco Talos Intelligence for Enterprise Security Cloud version 1.0.3 or later. Refer to the Splunk Security Advisory SVD-2026-0808 for full remediation details and the Splunk deployment documentation for upgrade guidance.
Workarounds
- Place Splunk Web behind a reverse proxy that enforces authentication on static file paths serving add-on assets
- Apply network-level access controls to prevent unauthenticated internet exposure of Splunk Web
- Remove or restrict the vulnerable OpenAPI specification file from the static asset directory until the patch is applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
