What is the CVSS score of CVE-2025-20298?

CVE-2025-20298 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows are affected by CVE-2025-20298?

Splunk Universal Forwarder for Windows contains a privilege escalation vulnerability affecting versions below 9.4.2, 9.3.4, 9.2.6, and 9.1.9 that allows local non-administrator users to read and…. A patch is available.

How to fix or mitigate CVE-2025-20298?

Within 24 hours: Inventory all Splunk Universal Forwarder deployments on Windows systems and identify current versions. Within 7 days: Upgrade affected instances to patched versions (9.4.2, 9.3.4, 9.2.6, or 9.1.9 minimum depending on current branch). Within 30 days: Audit file permissions on Splunk installation directories across all Windows endpoints to confirm remediation and document compliance.

Windows CVE-2025-20298

EUVD-2025-16672 HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2025-06-02 psirt@cisco.com

Windows Privilege Escalation Information Disclosure Microsoft Splunk Universal Forwarder

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:45 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

9.2.6,9.1.9,9.3.4

EUVD ID Assigned

Mar 14, 2026 - 16:47 euvd

EUVD-2025-16672

Analysis Generated

Mar 14, 2026 - 16:47 vuln.today

CVE Published

Jun 02, 2025 - 18:15 nvd

HIGH 8.0

DescriptionCVE.org

In Universal Forwarder for Windows versions below 9.4.2, 9.3.4, 9.2.6, and 9.1.9, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory (by default, C:\Program Files\SplunkUniversalForwarder). This lets non-administrator users on the machine access the directory and all its contents.

AnalysisAI

Privilege escalation vulnerability in Splunk Universal Forwarder for Windows where incorrect file system permissions are assigned during installation or upgrade, allowing non-administrator users to read and modify sensitive files in the installation directory. This affects versions below 9.4.2, 9.3.4, 9.2.6, and 9.1.9, and could enable unauthorized access to credentials, configuration files, and system monitoring data. While CVSS 8.0 indicates high severity, real-world exploitation requires local access and user interaction (UI requirement per vector), limiting attack scope.

Technical ContextAI

This vulnerability stems from CWE-732 (Incorrect Permission Assignment for Critical Resource), where the Universal Forwarder installer/upgrade process fails to properly restrict NTFS ACLs on the installation directory and nested folders. By default, C:\Program Files\SplunkUniversalForwarder and its contents (including configuration files, credential stores, and binaries) are left with overly permissive access controls, allowing any authenticated local user to enumerate and potentially modify them. The affected CPE range is cpe:2.7:a:splunk:universal_forwarder:*:*:*:*:*:windows:*. This is distinct from UAC bypass vulnerabilities—it's a post-installation security configuration flaw affecting Windows NTFS permissions, not privilege escalation during execution.

RemediationAI

action: Upgrade to patched versions; versions: ['9.4.2 or later', '9.3.4 or later', '9.2.6 or later', '9.1.9 or later']; details: Apply the latest patch version matching your release branch. Splunk advisory should be consulted at https://www.splunk.com/en_us/product-security.html for official patch links.
action: Manual ACL remediation (interim workaround); steps: ['On affected systems, manually correct NTFS permissions on C:\\Program Files\\SplunkUniversalForwarder', 'Restrict access to Administrators and SYSTEM only', "Remove implicit 'Users' group read/write access via icacls or Group Policy", 'Verify with: icacls "C:\\Program Files\\SplunkUniversalForwarder" /T']; caveat: Workaround does not address root cause; patching is required.
action: Restrict standard user permissions; details: Implement Group Policy or local security policy to prevent standard users from accessing Program Files directories via NTFS permissions or AppLocker rules (defense-in-depth).