EUVD-2026-62955
GHSA-x4c2-cp22-3gjj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify network-accessible Splunk Web instance
-
DeliveryRequest static OpenAPI spec path without credentials
-
ExploitEnumerate REST API endpoints and authentication model
-
ExecutionCraft targeted follow-on API requests
-
ImpactAttempt API-layer exploitation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to a Splunk Web instance running Cisco Talos Intelligence for Enterprise Security Cloud in a version below 1.0.3. No authentication, elevated privileges, or user interaction is required - CVSS PR:N and UI:N are confirmed by the vendor-provided vector. The critical limiting factor is network reachability of Splunk Web: if Splunk Web is restricted to internal networks or requires VPN/authenticated proxy access, unauthenticated external exploitation is blocked. The impact is confined to information disclosure of API documentation; this vulnerability alone does not grant API access, data exfiltration capability, or code execution. |
| Impact | The CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately characterizes the exposure: zero-friction unauthenticated network access, but impact limited strictly to information disclosure with no integrity or availability consequence. No CISA KEV listing and no POC code are present in the available data, and EPSS data was not provided, so exploitation probability cannot be numerically assessed. The practical risk is reconnaissance enablement rather than direct compromise - an attacker learns API structure and authentication scheme, which lowers the effort required for follow-on targeted attacks against the add-on's REST API. Risk is materially elevated in deployments where Splunk Web is exposed to untrusted or internet-facing networks, and substantially reduced where Splunk Web is restricted to internal or VPN-only access. This is a genuine but bounded issue: it does not on its own expose credentials, session tokens, or sensitive data. |
| Exploit ScenarioDerived | An unauthenticated attacker with network access to a Splunk Web instance sends an HTTP GET request to the known static file path where the add-on packages its OpenAPI specification. The server responds with the full API contract, including endpoint URLs, HTTP methods, parameter names, and authentication scheme details. The attacker uses this documentation to craft precise API calls - potentially targeting authentication bypass, privilege escalation, or data access endpoints - in subsequent attack phases. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Unauthenticated exposure of the OpenAPI specification in Cisco Talos Intelligence for Enterprise Security Cloud (versions below 1.0.3) allows any network-accessible user to retrieve the add-on's full REST API documentation via Splunk Web static file paths. The disclosed specification reveals API endpoint structure and the authentication model, enabling reconnaissance that could facilitate targeted follow-on attacks. No active exploitation or public exploit code has been identified at time of analysis.
RemediationAI
Upgrade Cisco Talos Intelligence for Enterprise Security Cloud to version 1.0.3 or later, which resolves the unauthenticated static file exposure. Full upgrade guidance is provided in the Splunk vendor advisory SVD-2026-0808 at https://advisory.splunk.com/advisories/SVD-2026-0808 and in the Splunk documentation at https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/introduction/deploy-cisco-talos-intelligence-for-splunk-enterprise-security-cloud-only. As a compensating control prior to patching, restrict network access to Splunk Web to trusted internal networks or authenticated VPN sessions; this eliminates unauthenticated external access to the static file path without requiring immediate upgrade, though it does not remove the underlying misconfiguration.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Talos Intelligence for Enterprise Security Cloud is a Splunk add-on (CPE: cpe:2.3:a:splunk:cisco_talos_intelligence_for_enterprise_security_cloud) that integrates Cisco Talos threat intelligence feeds into Splunk Enterprise Security. The root cause (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) is that the add-on packages its auto-generated OpenAPI specification - which fully describes REST API paths, parameter schemas, and the authentication model - as a static asset that Splunk Web serves from a predictable path without enforcing any access control. OpenAPI specifications are machine-readable API contracts; exposure allows automated enumeration of all endpoints without interacting with the API itself.
Know when Cisco Talos Intelligence For Enterprise Security Cloud gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network access to a static file path; only API documentation is disclosed with no integrity or availability impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer (REST) API endpoints and authentication model. The vulnerability is possible because the generated OpenAPI specification is packaged in a static file path that Splunk Web serves without authentication. For more information see Deploy Cisco Talos Intelligence for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/introduction/deploy-cisco-talos-intelligence-for-splunk-enterprise-security-cloud-only) in the Splunk documentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB