CVE-2025-20383: Splunk Enterprise · The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affects Splunk EnterpriseSource CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 22% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 3 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Splunk Splunk Enterprise | Affected
| Fixed in– |
AI-suggested
To mitigate this vulnerability, European organizations should promptly upgrade affected Splunk Enterprise instances to versions 10.0.2, 9.4.6, 9.3.8, or 9.2.10 or later, and update the Splunk Secure Gateway app to versions 3.9.10, 3.8.58, or 3.7.28 or later. Until patches are applied, organizations should audit and restrict mobile push notification subscriptions, especially for users without admin or power roles, to prevent unauthorized exposure. Implement strict role-based access controls (RBAC) to limit which users can subscribe to notifications and review notification content policies to minimize sensitive information included in alerts. Monitoring and alerting on unusual subscription patterns or notification delivery to low-privileged users can help detect potential exploitation attempts. Additionally, organizations should educate users about the risks of subscribing to mobile push notifications and enforce multi-factor authentication (MFA) to reduce the risk of account compromise. Regularly reviewing Splunk configurations and applying security best practices for SIEM deployments will further reduce exposure.
Description
In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and below 3.9.10, 3.8.58, and 3.7.28 of Splunk Secure Gateway app in Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles and subscribes to mobile push notifications could receive notifications that disclose the title and description of the report or alert even if they do not have access to view the report or alert.