CVE-2026-76390

MediumCVSS 5.3

Published: 19/08/2026(UTC)Updated: 21/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

22th percentile - higher than 22% of all known CVEs

Summary

Risk Assessment

An attacker could perform infrastructure reconnaissance, potentially facilitating further attacks on APIs and authentication mechanisms.

Recommendation

Upgrade Cisco Talos Intelligence for Enterprise Security Cloud to version 1.0.3 or later to secure the OpenAPI specification.

Other vulnerabilities in Cisco Talos Intelligence for Enterprise Security Cloud

CVE-2026-76389High
In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user with the get_talos_enrichment capability could send a crafted request to the Talos intelligence enrichment REST API endpoint and cause the instance to make an outbound request to an attacker-controlled server. The request could expose tokens that compromise all relevant data and system integrity in the Splunk instance.

Original NVD description (English source)

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer (REST) API endpoints and authentication model. The vulnerability is possible because the generated OpenAPI specification is packaged in a static file path that Splunk Web serves without authentication. For more information see Deploy Cisco Talos Intelligence for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/introduction/deploy-cisco-talos-intelligence-for-splunk-enterprise-security-cloud-only) in the Splunk documentation.