CVE-2026-76390: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. in Splunk Cisco Talos Intelligence for Enterprise Security Cloud

In Cisco Talos Intelligence for Enterprise Security Cloud versions >=1.0 and <1.0.3, an unauthenticated actor can access the add-on OpenAPI specification through Splunk Web static file paths. This specification is served without authentication, allowing the actor to gather information about the REST API endpoints and authentication mechanisms. The vulnerability stems from the packaging of the OpenAPI specification in a static file path accessible without authentication.

The vulnerability exposes sensitive information about the REST API endpoints and authentication model to unauthenticated users. While it does not directly allow modification or denial of service, the information disclosure could facilitate further targeted attacks or reconnaissance activities.

Upgrade Cisco Talos Intelligence for Enterprise Security Cloud to version 1.0.3 or later, where this vulnerability is fixed. Since this is a product vulnerability with an available fixed version, applying the official update is the recommended remediation.