CVE-2025-20388VulnerabilityPublished 3 Dec 2025

CVE-2025-20388: Splunk Enterprise · The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affects Splunk EnterpriseSource CVE Database V5

Not known to be exploited · CVSS 2.7 Low.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

2.7Low

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.3% chance of exploitation in 30 days – higher than 28% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: High
User Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: High: The attacker is authorized with (i.e., requires) privileges that provide significant (e.g., administrative) control over the vulnerable component that could affect component-wide settings and files.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 3 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Splunk Splunk Enterprise	Affected =10.0 =9.4 =9.3 =9.2	Fixed in–

AI-suggested

European organizations should implement the following specific mitigations: 1) Upgrade Splunk Enterprise and Splunk Cloud Platform to the patched versions 10.0.1, 9.4.6, 9.3.8, 9.2.10 or later as applicable. 2) Restrict the 'change_authentication' capability to a minimal number of trusted administrators and regularly review role assignments to prevent privilege creep. 3) Monitor and audit usage of high-privilege roles to detect unusual activity indicative of reconnaissance attempts. 4) Employ network segmentation and firewall rules to limit communication between Splunk components and sensitive internal networks, reducing the value of any enumeration. 5) Use Splunk's internal logging and alerting features to detect attempts to add search peers or unusual URL requests within the system. 6) Conduct regular security training for administrators on the risks of privilege misuse. 7) Consider implementing multi-factor authentication for accounts with high privileges to reduce the risk of account compromise. These measures go beyond generic patching by focusing on privilege management, monitoring, and network controls tailored to the vulnerability's exploitation vector.

Description

CVE-2025-20388 is a low-severity vulnerability in Splunk Enterprise and Splunk Cloud Platform versions prior to specified patched releases. It allows users with the high-privilege capability 'change_authentication' to enumerate internal IP addresses and network ports by adding new search peers in a distributed Splunk environment. The vulnerability arises because the web server does not sufficiently verify that URL requests from upstream components target expected destinations. Exploitation requires authenticated access with elevated privileges but does not require user interaction. Although the confidentiality impact is limited to internal network information disclosure, this could aid attackers in further reconnaissance. No known exploits are reported in the wild. European organizations using affected Splunk versions in distributed deployments should prioritize patching and restrict high-privilege roles to trusted administrators. Countries with significant Splunk Enterprise adoption and critical infrastructure monitoring, such as Germany, the UK, France, and the Netherlands, are most likely to be affected.

Impact

For European organizations, this vulnerability primarily poses a risk of internal network reconnaissance by privileged users who may be malicious or whose accounts have been compromised. Disclosure of internal IP addresses and open ports can aid attackers in mapping network infrastructure, identifying vulnerable services, and planning subsequent attacks such as lateral movement or privilege escalation. While the direct impact on confidentiality is limited, the information gained could be leveraged in multi-stage attacks against critical systems. Organizations relying heavily on Splunk for security monitoring, especially those in regulated sectors like finance, energy, and government, could face increased risk if attackers use this vulnerability to gather intelligence on internal networks. The vulnerability does not affect data integrity or availability, and exploitation requires elevated privileges, reducing the risk of widespread exploitation. However, in environments with insufficient role separation or compromised administrator accounts, the threat is more significant. The lack of known exploits reduces immediate risk but does not eliminate the need for remediation.

Summary

CVE-2025-20388 is a vulnerability identified in Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, as well as corresponding Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116. The issue stems from insufficient validation by the Splunk web server when it receives URL requests from upstream components, specifically during the process of adding new search peers in a distributed Splunk search head environment. Users possessing the 'change_authentication' capability—a high privilege role—can exploit this flaw to enumerate internal IP addresses and network ports. This enumeration occurs because the server does not adequately ensure that the requested URLs are directed to expected or authorized destinations, allowing an attacker to gain insight into internal network topology. The vulnerability does not allow modification or disruption of data (no integrity or availability impact) but leaks internal network information, which could facilitate further targeted attacks. The CVSS v3.1 base score is 2.7, reflecting low severity due to the requirement for high privileges and the limited impact scope. No user interaction is needed, and the attack vector is network-based. There are no known public exploits at this time. The vulnerability is relevant primarily in distributed Splunk deployments where search heads communicate with multiple peers, a common architecture in large-scale enterprise environments.

References

advisory.splunk.com/advisories/SVD-2025-1207 (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Dec 2025, 18:37 UTC

Technical details

References

Community reviews

Related threats