CVE-2025-20386

Summary

In Splunk Enterprise for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Splunk Enterprise for Windows Installation directory. This lets non-administrator users on the machine access the directory and all its contents.

Affected Software

VendorProductVersion RangeStatus
SplunkSplunk Enterprise10.0 < 10.0.2affected
SplunkSplunk Enterprise9.4 < 9.4.6affected
SplunkSplunk Enterprise9.3 < 9.3.8affected
SplunkSplunk Enterprise9.2 < 9.2.10affected

Weaknesses

  • CWE-732: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References