CVE-2025-20300: Splunk Enterprise Privilege Escalation

CVE-2025-20300 Overview

CVE-2025-20300 is an authorization flaw in Splunk Enterprise and Splunk Cloud Platform. A low-privileged user who lacks the admin or power role, but holds read-only access to a specific alert, can suppress that alert when it triggers. The issue falls under [CWE-863: Incorrect Authorization] and stems from improper permission enforcement around alert suppression groups. Splunk assigned the vulnerability a CVSS 3.1 score reflecting a network attack vector with low privileges required and no user interaction. Affected releases include Splunk Enterprise below 9.4.2, 9.3.5, 9.2.6, and 9.1.9, and Splunk Cloud Platform below 9.3.2411.103, 9.3.2408.112, and 9.2.2406.119.

Critical Impact
A low-privileged user with read-only access to an alert can suppress that alert on trigger, blocking downstream detection and response workflows.

Affected Products

Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.6, and 9.1.9
Splunk Cloud Platform versions below 9.3.2411.103 and 9.3.2408.112
Splunk Cloud Platform versions below 9.2.2406.119

Discovery Timeline

2025-07-07 - CVE-2025-20300 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20300

Vulnerability Analysis

The vulnerability resides in how Splunk enforces access control on alert suppression groups. Splunk allows administrators to define suppression groups that throttle sets of similar alerts, preventing repeated notifications for the same event pattern. The authorization check for creating or applying a suppression group does not fully validate whether the acting user has write authority over the target alert. As a result, a user with only read permission on an alert can attach that alert to a suppression configuration and silence trigger notifications. The impact is limited to integrity of alert delivery; confidentiality and availability of the underlying data are not affected. Attackers who obtain low-privileged Splunk credentials can weaponize the flaw to hide indicators of compromise generated by security detections.

Root Cause

The root cause is an incorrect authorization decision in the alert suppression code path. Splunk permits users with read-only access to influence the trigger behavior of an alert they cannot otherwise modify, contradicting the least-privilege model that separates user, power, and admin roles.

Attack Vector

Exploitation requires network access to the Splunk web or REST API and valid credentials for any Splunk role that has read visibility on the target alert. The attacker interacts with the alert configuration or throttling interface to define a suppression group covering the alert. Once suppression is applied, subsequent triggers of the alert do not generate notifications or downstream actions during the throttling window. No user interaction from an administrator is required. See the Splunk Security Advisory SVD-2025-0708 for vendor details.

Detection Methods for CVE-2025-20300

Indicators of Compromise

Unexpected creation or modification of alert suppression groups by non-admin, non-power users in savedsearches.conf or via the REST API.
Gaps in expected alert notifications for scheduled saved searches that historically fired regularly.
Audit log entries showing edit_search_scheduling or alert throttling API calls originating from low-privileged accounts.

Detection Strategies

Query the _audit and _internal indexes for REST calls to /services/saved/searches/* with suppression parameters (alert.suppress, alert.suppress.fields, alert.suppress.period) authored by non-admin users.
Baseline the list of users authorized to manage alerts and alert on deviations in change events for saved searches.
Correlate alert-silence periods with recent authentication activity from low-privileged accounts to surface probable abuse.

Monitoring Recommendations

Enable and forward Splunk audit logs to an independent SIEM or data lake to prevent tampering by the same platform under attack.
Alert on any modification to alert throttling configuration outside of change-management windows.
Review role assignments and remove read access to sensitive security alerts from users who do not require it.

How to Mitigate CVE-2025-20300

Immediate Actions Required

Upgrade Splunk Enterprise to 9.4.2, 9.3.5, 9.2.6, 9.1.9, or later as applicable to your release train.
Confirm Splunk Cloud Platform tenants are running 9.3.2411.103, 9.3.2408.112, 9.2.2406.119, or later; contact Splunk support if uncertain.
Audit historical suppression group changes and revert unauthorized modifications made by non-admin users.

Patch Information

Splunk addressed the issue in the fixed versions listed above. Refer to the Splunk Security Advisory SVD-2025-0708 for the complete list of remediated builds and upgrade guidance. Splunk Cloud Platform customers receive the patch through the standard maintenance pipeline.

Workarounds

Restrict read access on sensitive alerts to users who require it, minimizing the pool of accounts that meet the exploitation precondition.
Review and tighten role capabilities so that only admin and power roles can edit scheduled searches and throttling settings.
Monitor and alert on changes to savedsearches.conf suppression stanzas as a compensating control until patching is complete.

bash

# Configuration example: identify suppression changes by non-admin users
index=_audit action=edit operation="edit_search_scheduling" \
  | search info=granted \
  | search NOT (user=admin OR user IN ("power_user_1","power_user_2")) \
  | table _time user object action info