Splunk Enterprise CVE-2025-20368

Exploitation requires an authenticated Splunk account that does NOT hold the admin or power role (PR:L), so an attacker must already have a valid low-privileged login on the instance. The specific trigger is a malicious payload embedded in a saved search that surfaces through that search's error messages and job-inspection details. Exploitation is limited by required victim interaction (UI:R): a second user must actively view those error/job-inspection details for the stored JavaScript to execute, meaning there is no fully automated or self-propagating path. Impact is greatest when the viewing victim is a higher-privileged user such as an administrator. Instances already upgraded to Splunk Enterprise 9.4.4/9.3.6/9.2.8 or the fixed Splunk Cloud Platform builds (9.3.2411.108, 9.3.2408.118, 9.2.2406.123) are not affected.

This is a stored/DOM cross-site scripting flaw (CWE-79) in Splunk Enterprise and Splunk Cloud Platform. The signals are consistent and all point to a genuine-but-moderate priority rather than an emergency. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects a network vector but with real limiting factors: the attacker must already authenticate as a low-privileged Splunk user (PR:L) and a victim must interact (UI:R) by viewing the crafted error messages or job-inspection details of a saved search. EPSS is very low at 0.03% (8th percentile), the vulnerability is NOT on the CISA KEV list, and no public exploit code is identified in the provided data - so there is no evidence of active or imminent mass exploitation. The scope-change flag (S:C) is the one element that raises impact: the injected JavaScript executes in another user's browser context, which is why confidentiality and integrity are rated Low rather than None. No signals conflict here; the low EPSS, absence of KEV, and absence of a POC all align with a vulnerability that is real and should be patched on a normal cadence, but is not a drop-everything issue. The main residual risk is privilege escalation - if the script executes in an admin's browser, session or action hijacking becomes possible.

A low-privileged authenticated Splunk user who lacks the admin or power role creates a saved search containing a malicious payload that surfaces through the search's error messages or job-inspection details. When a higher-privileged user (e.g. an administrator) later views those error or inspection details, the attacker's JavaScript executes in that victim's browser session, potentially enabling session/action hijacking. No public exploit code was identified at time of analysis.