Full Report
Splunk disclosed high-severity vulnerabilities in Windows Enterprise and Universal Forwarder on Dec 3, 2025. See affected versions and remediation steps.
Analysis Summary
# Vulnerability: Incorrect File Permissions in Splunk Enterprise and Universal Forwarder (Windows)
## CVE Details
- CVE ID: CVE-2025-20386 and CVE-2025-20387 (Two distinct but related CVEs disclosed simultaneously)
- CVSS Score: 8.0 (High)
- CWE: Incorrect default configuration or permissions (Inferred from description)
## Affected Systems
- Products: Splunk Enterprise and Splunk Universal Forwarder
- Versions: All prior versions prior to the patched releases listed below (Specific vulnerable ranges were not detailed, but all Windows versions prior to patching qualify).
- Configurations: Windows operating systems where Splunk Enterprise or Universal Forwarder is installed.
## Vulnerability Description
The vulnerabilities stem from incorrect file permissions established during the installation and upgrading processes of Splunk components on Windows. These misconfigurations grant overly broad access rights to sensitive installation directories. This flaw allows a non-administrator user to gain unauthorized access, potentially enabling them to read, write, or tamper with critical files, which could escalate into a privilege escalation scenario.
## Exploitation
- Status: No active exploitation has been confirmed.
- Complexity: Not explicitly stated, but local privilege escalation via incorrect permissions is often considered Medium to Low complexity once access is achieved.
- Attack Vector: Local (Requires presence on the affected endpoint, exploited by a non-administrator user).
## Impact
- Confidentiality: High (Unauthorized access to sensitive files)
- Integrity: High (Ability to tamper with critical files)
- Availability: Potential impact due to file modification/corruption.
## Remediation
### Patches
Organizations are urged to upgrade immediately to the following patched versions:
- Splunk Enterprise/Universal Forwarder: 10.0.2
- Splunk Enterprise/Universal Forwarder: 9.4.6
- Splunk Enterprise/Universal Forwarder: 9.3.8
- Splunk Enterprise/Universal Forwarder: 9.2.10
### Workarounds
No specific workarounds were detailed in the provided summary, but patching is strongly urged due to the severity and potential for privilege escalation.
## Detection
- Indicators of compromise: Look for unexpected file modifications or access attempts within Splunk installation directories by non-administrator accounts.
- Detection methods and tools: Monitor file system access logs (e.g., using Sysmon or native Windows auditing) for suspicious read/write operations on sensitive components by low-privilege users.
## References
- Vendor advisories: splunk.com/advisories/SVD-2025-1205, splunk.com/advisories/SVD-2025-1206 (Defanged)
- Relevant links - defanged: upguard.com/blog/splunk-enterprise-vulnerabilities-cve-2025-20386-and-cve-2025-20387