CVE-2025-20371: In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an…

PriorityP353high8.8CVSS 3.1

AVNACLPRNUIRSUCHIHAH

EPSS

0.44%

35.0th percentile

In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF) potentially letting an attacker perform REST API calls on behalf of an authenticated high-privileged user.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
splunk	splunk	—	—
splunk	splunk	>= 9.2.0 < 9.2.8	9.2.8
splunk	splunk	>= 9.3.0 < 9.3.6	9.3.6
splunk	splunk	>= 9.4.0 < 9.4.4	9.4.4
splunk	splunk_cloud_platform	>= 9.2.2406 < 9.2.2406.122	9.2.2406.122
splunk	splunk_cloud_platform	>= 9.3.2408 < 9.3.2408.119	9.3.2408.119
splunk	splunk_cloud_platform	>= 9.3.2411 < 9.3.2411.109	9.3.2411.109
splunk	splunk_enterprise	>= 10.0 < 10.0.1	10.0.1
splunk	splunk_enterprise	>= 9.2 < 9.2.8	9.2.8
splunk	splunk_enterprise	>= 9.3 < 9.3.6	9.3.6
splunk	splunk_enterprise	>= 9.4 < 9.4.4	9.4.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.