VulnerabilityPublished 26 Nov 2025

CVE-2025-20373: Splunk Add-on for Palo Alto Networks · Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

Affects Splunk Add-on for Palo Alto NetworksSource CVE Database V5

Not known to be exploited · CVSS 2.7 Low.

Data as of 26 Oct 2026, 09:15 UTC

CVSS 3.1 base score

2.7Low

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 12% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: High
User Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: High: The attacker is authorized with (i.e., requires) privileges that provide significant (e.g., administrative) control over the vulnerable component that could affect component-wide settings and files.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 26 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Splunk Splunk Add-on for Palo Alto Networks	Affected =2.0	Fixed in–

AI-suggested

European organizations should immediately review and restrict access to the Splunk internal index, ensuring only trusted administrator-level roles have access. Implement strict role-based access controls and audit logs for any access to internal indexes. Upgrade the Splunk Add-on for Palo Alto Networks to version 2.0.2 or later, where this logging issue is resolved. Avoid storing sensitive credentials in logs or plaintext files and consider encrypting any necessary sensitive data within logs. Regularly review Splunk configurations and user roles to minimize privilege creep. Employ network segmentation and host-based controls to limit local access to Splunk servers. Additionally, monitor for unusual access patterns to internal indexes and conduct periodic security assessments of Splunk deployments. Incorporate these controls into compliance frameworks to ensure adherence to European data protection standards.

Description

CVE-2025-20373 is a low-severity vulnerability in Splunk Add-on for Palo Alto Networks versions below 2.0.2 where client secrets are logged in plaintext within the internal index. Exploitation requires either local access to log files or administrative privileges to internal indexes, which are typically restricted to admin roles. This exposure could allow attackers with such access to obtain sensitive credentials, aiding further attacks or lateral movement. The vulnerability does not impact integrity or availability and requires high privileges, limiting its exploitability. European organizations using affected Splunk add-on versions should review and restrict internal index access and upgrade to patched versions. Countries with significant Splunk and Palo Alto Networks deployments and critical infrastructure monitoring are most at risk. Mitigation involves strict role-based access control, auditing internal index access, and applying updates promptly. The CVSS score of 2.

Impact

For European organizations, this vulnerability poses a risk primarily to confidentiality if an attacker gains administrative access to Splunk internal indexes or local system access. Exposure of client secrets could lead to unauthorized access to Palo Alto Networks integrations or data, potentially facilitating further compromise or data exfiltration. Organizations relying heavily on Splunk for security monitoring and Palo Alto Networks for network security may face increased risk if internal access controls are lax. Critical infrastructure sectors such as finance, energy, and government agencies in Europe, which often deploy these technologies, could be targeted for espionage or disruption. However, the requirement for high privileges and no direct impact on integrity or availability reduces the overall threat level. Still, the presence of sensitive credentials in logs represents a compliance and operational risk, especially under GDPR and other data protection regulations prevalent in Europe.

Summary

CVE-2025-20373 affects the Splunk Add-on for Palo Alto Networks versions below 2.0.2, where sensitive client secrets are inadvertently logged in plaintext within the _internal index during the configuration of new Data Security Accounts. This vulnerability arises because the add-on writes these secrets directly to log files accessible via the internal Splunk index, which is by default only accessible to users with administrative privileges. An attacker with local access to the system or administrative access to the internal index could extract these secrets, potentially enabling unauthorized access to Palo Alto Networks data or systems. However, exploitation requires either local system access or elevated Splunk privileges, which limits the attack surface. The vulnerability does not affect data integrity or system availability, and no user interaction is required. The CVSS 3.1 score of 2.7 (low) reflects the limited confidentiality impact and high privilege requirement. No known exploits are currently reported in the wild. The vulnerability highlights the importance of secure logging practices and strict role-based access controls within Splunk environments, especially when handling sensitive credentials.

References

advisory.splunk.com/advisories/SVD-2025-1105 (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 3 Dec 2025, 18:58 UTC

Technical details

References

Community reviews

Related threats