Full Report
Splunk disclosed high-severity vulnerabilities in Windows Enterprise and Universal Forwarder on Dec 3, 2025. See affected versions and remediation steps.
Analysis Summary
# Vulnerability: Incorrect File Permissions in Splunk Enterprise and Universal Forwarder (Windows)
## CVE Details
- CVE ID: CVE-2025-20386 and CVE-2025-20387
- CVSS Score: 8.0 (High)
- CWE: (Not explicitly detailed, but related to improper access control/permissions)
## Affected Systems
- Products: Splunk Enterprise, Splunk Universal Forwarder
- Versions: Specific vulnerable versions are implied by the corresponding patches listed below (users must check the advisory for exact ranges unless they are using the patched versions).
- Configurations: Impacting Windows installations of the affected products.
## Vulnerability Description
The vulnerabilities stem from incorrect file permissions applied during the installation and upgrade processes of Splunk Enterprise and Universal Forwarder on Windows. These misconfigurations grant non-administrator users improper access to sensitive installation directories. This improper access could allow a local, low-privilege user to read, write, or tamper with critical files, leading to potential local privilege escalation.
## Exploitation
- Status: No active exploitation confirmed.
- Complexity: Likely Low (Requires local access, but misconfiguration simplifies the attack path).
- Attack Vector: Local
## Impact
- Confidentiality: Potential (Unauthorized reading of sensitive files)
- Integrity: High (Unauthorized modification or tampering with critical files)
- Availability: Potential (Tampering could lead to service disruption)
## Remediation
### Patches
Organizations are urged to upgrade immediately. Patched versions include:
- 10.0.2
- 9.4.6
- 9.3.8
- 9.2.10
### Workarounds
The primary mitigation is upgrading to the patched versions. (No specific temporary workarounds were detailed in the provided context, implying immediate patching is required.)
## Detection
- Indicators of compromise: Unauthorized modifications or access attempts within Splunk installation directories by non-administrator accounts.
- Detection methods and tools: Monitor file system access logs on Windows servers hosting Splunk for anomalous read/write operations by low-privileged users in Splunk installation paths.
## References
- Vendor Advisories: https://advisory.splunk.com/advisories/SVD-2025-1205 (For CVE-2025-20386)
- Vendor Advisories: https://advisory.splunk.com/advisories/SVD-2025-1206 (For CVE-2025-20387)