Splunk Enterprise EUVD-2025-32713

Exploitation requires a blind SSRF in Splunk Enterprise (versions below 10.0.1, 9.4.4, 9.3.6, 9.2.8) or Splunk Cloud Platform (below 9.3.2411.109, 9.3.2408.119, 9.2.2406.122) to be triggered in a way that reaches internal REST endpoints. The attacker themselves is unauthenticated (PR:N), but the CVSS vector specifies UI:R - a limiting factor meaning a legitimate authenticated, high-privileged Splunk user must interact with or process the attacker-supplied content for the SSRF to fire in that privileged context. There is no indication of a non-default configuration requirement in the description; the key realistic limiter is the need to involve a high-privileged user, which constrains fully autonomous mass exploitation.

Signals here conflict and should be weighed carefully. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) rates this high, driven by network reach, no attacker authentication (PR:N), and full confidentiality/integrity/availability impact once the SSRF is leveraged to make REST API calls as a high-privileged user. However, two factors materially dampen real-world urgency: the vector requires user interaction (UI:R), meaning a high-privileged Splunk user must be induced to trigger the request, and the EPSS score is only 0.08% (23rd percentile), indicating very low modeled exploitation probability. The vulnerability is NOT in CISA KEV and no public exploit code was identified, so there is no public exploit identified at time of analysis. No SSVC decision data was provided in the input. Net assessment: this is a legitimate high-severity patch-priority item for internet-exposed or multi-user Splunk deployments because it is a blind SSRF that can escalate to privileged REST API actions, but the UI:R requirement plus low EPSS and absence of KEV/POC suggest it is not under active mass exploitation - treat it as scheduled high-priority remediation rather than emergency zero-day response.

An unauthenticated attacker crafts malicious content that, when accessed or processed by an authenticated high-privileged Splunk user, causes the Splunk server to issue attacker-influenced internal requests (blind SSRF). Because the request executes in the context of that privileged user, it can perform Splunk REST API calls on their behalf, enabling actions the attacker could not take directly. No public proof-of-concept was identified, and the attack requires the privileged user interaction reflected in the CVSS UI:R metric.