CVE-2025-20387

Incorrect permissions assignment on Splunk Universal Forwarder for Windows during new installation or upgrade

Severity
High 8
CVSS 3.1
Exploited
Not listed
EPSS
0.005
39.0th percentile
Discovered by
Not disclosed
Published
Dec 3, 2025
Assigned by cisco

Description

In Splunk Universal Forwarder for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory. This lets non-administrator users on the machine access the directory and all its contents.

Weakness: CWE-732

Affected products

Vendor Product Category Matched by

No product mapping yet — this CVE is pending taxonomy review.

Vendor-reported affected versions (1)
  • Splunk · Splunk Enterprise