CVE-2025-20323: Splunk Enterprise · The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Affects Splunk EnterpriseSource CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 22% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 7 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Splunk Splunk Enterprise | Affected
| Fixed in– |
AI-suggested
European organizations should prioritize upgrading Splunk Enterprise to versions 9.4.3, 9.3.5, 9.2.7, or 9.1.10 or later, where this vulnerability is addressed. In the interim, administrators should audit and tighten role-based access controls, ensuring that only authorized users with 'admin' or 'power' roles can modify or disable scheduled searches, particularly those related to data archival. Implement monitoring and alerting on changes to critical scheduled searches like 'Bucket Copy Trigger' to detect unauthorized modifications promptly. Additionally, organizations should review Splunk app configurations and saved searches for any other potential access control weaknesses. Employing Splunk's audit logs to track user actions can aid in early detection of misuse. Finally, integrating Splunk with centralized identity and access management solutions can help enforce stricter access policies and reduce the risk of privilege escalation.
Description
In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could turn off the scheduled search `Bucket Copy Trigger` within the Splunk Archiver application. This is because of missing access controls in the saved searches for this app.