CVE-2025-20387 Incorrect permissions assignment on Splunk Universal Forwarder for Windows during new installation or upgrade
Incorrect directory permissions allow non-administrator users to access Splunk Universal Forwarder files, potentially leading to data exposure or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-20387?
CVE-2025-20387 is a high-severity vulnerability in Splunk Splunk, published on 3 Dec 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In Splunk Universal Forwarder for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory. This lets non-administrator users on the machine access the directory and all its contents.
Weakness: CWE-732
Which versions are affected by CVE-2025-20387?
It affects 1 product.
Products include Splunk Splunk.
How do I fix CVE-2025-20387?
No fix has been published for CVE-2025-20387 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-20387 being exploited?
There is no known exploitation of CVE-2025-20387 in the wild and no public exploit code.
Other vulnerabilities in Splunk Splunk
- CVE-2026-20253 Splunk Enterprise Missing Authentication for Critical Function
- CVE-2026-76268 Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise
- CVE-2026-76284 Improper Neutralization in Splunk Enterprise
- CVE-2026-76285 Improper Adherence to Coding Standards in Splunk Enterprise
- CVE-2017-17067 Auth bypass in n/a
Sources
Also known as GHSA-99hp-3vr6-f5r2.