This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Splunk fixes 10 vulnerabilities

Splunk fixes 10 vulnerabilities in various products. The most severe ones are described below [1][2][3]; the remaining ones can be found at [4][5][6][7][8][9][10]. Individual products and their latest fixed versions: Splunk Enterprise [1][3][4][5][6][7][8][9] - 10.0.2, 9.4.6, 9.3.8, 9.2.10 Splunk Universal Forwarder [2] - 10.0.2, 9.4.6, 9.3.8, 9.2.10 Splunk Cloud Platform [4][5][6][7][8][9] - 10.1.2507.10, 10.0.2503.8, 9.3.2411.120 Splunk Secure Gateway [8][9] - 3.9.10, 3.8.58, 3.7.28 Splunk MCP Server [10] - 0.2.4

Splunk Enterprise - file read/modification (CVE-2025-20386)
CVSS 8.0 (High)

Due to incorrect permission assignment during the installation of Splunk Enterprise on Windows, an authenticated remote attacker can gain unauthorized access to the installation folder and read/modify its contents [1][11]. If an immediate update to a fixed version is not possible, information on temporary mitigation can be found at [1].

The vulnerability is present in product:

  • Windows: Splunk Enterprise; >=9.2.0, <=9.2.9; >=9.3.0, <=9.3.7; >=9.4.0, <=9.4.5; >=10.0, <10.0.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 3. 12. 2025.

Splunk Universal Forwarder - file read/modification (CVE-2025-20387)
CVSS 8.0 (High)

Due to incorrect permission assignment during the installation of Splunk Universal Forwarder on Windows, an authenticated remote attacker can gain unauthorized access to the installation folder and read/modify its contents [2][11]. If an immediate update to a fixed version is not possible, information on temporary mitigation can be found at [2].

The vulnerability is present in product:

  • Windows: Splunk Universal Forwarder; >=9.2.0, <=9.2.9; >=9.3.0, <=9.3.7; >=9.4.0, <=9.4.5; >=10.0, <10.0.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 3. 12. 2025.

Splunk Enterprise - arbitrary file write, RCE (CVE-2025-47273)
CVSS 7.7 (High)

Due to a path traversal vulnerability in the setuptools library (part of Splunk Enterprise), an unauthenticated remote attacker can write files to arbitrary locations on the system without authorization and, under certain conditions, execute code [3][12].

The vulnerability is present in products:

  • Splunk Enterprise; >=9.2.0, <=9.2.9; >=9.3.0, <=9.3.7; >=9.4.0, <=9.4.5; >=10.0, <10.0.2;
  • setuptools; <78.1.1;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

More information:

  • CVE-2025-47273 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 17. 5. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 13. 12. 2025.

CESNET, z.s.p.o. Logo