CVE-2025-20300: Splunk Enterprise · The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Affects Splunk EnterpriseSource CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 22% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 7 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Splunk Splunk Enterprise | Affected
| Fixed in– |
AI-suggested
- Upgrade Splunk Enterprise and Splunk Cloud Platform to the fixed versions: 9.4.2 or later for Enterprise, and 9.3.2411.103 or later for Cloud Platform, as applicable.
- Review and tighten role-based access controls (RBAC) to minimize read-only access to alerts for low-privileged users, especially those without admin or power roles.
- Implement monitoring and auditing of alert suppression actions to detect unusual or unauthorized suppression activities.
- Use Splunk’s alerting and logging features to create secondary alerts or notifications when alert suppression settings are modified.
- Conduct regular security reviews and penetration testing focused on authorization controls within Splunk environments.
- Educate security teams about this vulnerability to increase awareness and encourage verification of alert integrity during investigations.
Description
In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.6, and 9.1.9 and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.112, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles, and has read-only access to a specific alert, could suppress that alert when it triggers. See [Define alert suppression groups to throttle sets of similar alerts](https://help.splunk.com/en/splunk-enterprise/alert-and-respond/alerting-manual/9.4/manage-alert-trigger-conditions-and-throttling/define-alert-suppression-groups-to-throttle-sets-of-similar-alerts).