CVE-2025-20388: In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a…

PriorityP412low2.7CVSS 3.1

AVNACLPRHUINSUCLINAN

EPSS

0.32%

23.3th percentile

In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability `change_authentication` could enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
msrc	cbl_mariner_1.0_arm	—	—
msrc	cbl_mariner_1.0_x64	—	—
msrc	cm1_libxml2_2.9.10-2_on_cbl_mariner_1.0	—	—
splunk	splunk	—	—
splunk	splunk	>= 9.2.0 < 9.2.10	9.2.10
splunk	splunk	>= 9.3.0 < 9.3.8	9.3.8
splunk	splunk	>= 9.4.0 < 9.4.6	9.4.6
splunk	splunk_cloud_platform	>= 10.0.2503 < 10.0.2503.6	10.0.2503.6
splunk	splunk_cloud_platform	>= 10.1.2507 < 10.1.2507.4	10.1.2507.4
splunk	splunk_cloud_platform	>= 9.3.2411 < 9.3.2411.116	9.3.2411.116
splunk	splunk_enterprise	>= 10.0 < 10.0.1	10.0.1
splunk	splunk_enterprise	>= 9.2 < 9.2.10	9.2.10
splunk	splunk_enterprise	>= 9.3 < 9.3.8	9.3.8
splunk	splunk_enterprise	>= 9.4 < 9.4.6	9.4.6

CVSS provenance

nvdv3.12.7LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

vendor_msrc7.5HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.