CVE-2025-20386
Incorrect permission assignment on Splunk Enterprise for Windows during new installation or upgrade
Severity
High 8
CVSS 3.1
Exploited
Not listed
EPSS
0.005
41.5th percentile
Discovered by
Not disclosed
Published
Dec 3, 2025
Assigned by cisco
Description
In Splunk Enterprise for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Splunk Enterprise for Windows Installation directory. This lets non-administrator users on the machine access the directory and all its contents.
Weakness: CWE-732
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Splunk Enterprise | SIEM & Log Management | cna-assigner |
Vendor-reported products (1)
- Splunk · Splunk Enterprise