CVE-2025-20386: Splunk Enterprise Privilege Escalation Flaw

CVE-2025-20386 Overview

CVE-2025-20386 is an insecure permissions vulnerability [CWE-732] in Splunk Enterprise for Windows. New installations and upgrades to affected versions assign incorrect permissions to the Splunk Enterprise installation directory. Non-administrator users on the host can access the directory and all of its contents.

The issue affects Splunk Enterprise for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10. Splunk documented the flaw in advisory SVD-2025-1205. The vulnerability exposes configuration files, credentials, and log data stored under the Splunk installation path.

Critical Impact

Low-privileged local users can read the entire Splunk Enterprise installation directory, exposing configuration, credentials, and indexed data on Windows hosts.

Affected Products

• Splunk Enterprise for Windows versions below 10.0.2
• Splunk Enterprise for Windows versions below 9.4.6, 9.3.8, and 9.2.10
• Microsoft Windows hosts running affected Splunk Enterprise installations

Discovery Timeline

• 2025-12-03 - CVE-2025-20386 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20386

Vulnerability Analysis

The vulnerability originates in the Windows installer for Splunk Enterprise. During a fresh install or upgrade to an affected version, the installer applies overly permissive Access Control Lists (ACLs) to the Splunk Enterprise installation directory. Standard, non-administrator user accounts on the machine inherit read access to the directory tree.

The installation directory contains sensitive artifacts. These include .conf files under etc\system\local, application configurations, TLS material, session tokens, and cached search results. Confidentiality of this data depends on strict ACLs that restrict access to the Splunk service account and administrators.

Exploitation does not require code execution or privilege escalation. Any interactive or service account on the host can enumerate and read files. This weakness is classified under [CWE-732: Incorrect Permission Assignment for Critical Resource].

Root Cause

The installer sets directory and file permissions incorrectly, granting read access to authenticated users or the local Users group instead of restricting access to administrators and the Splunk service account. The condition is introduced by the install and upgrade routines rather than by post-install configuration drift.

Attack Vector

An attacker with an existing low-privileged account on the Windows host reads files under the Splunk installation directory. Recovered configuration files can contain credentials, HEC tokens, LDAP bind information, and integration secrets. Attackers can then reuse these secrets to pivot to Splunk-connected systems or the Splunk management interface.

See the Splunk Security Advisory SVD-2025-1205 for vendor technical details.

Detection Methods for CVE-2025-20386

Indicators of Compromise

• Non-administrator user or service account processes reading files under the Splunk installation directory, particularly etc\system\local\*.conf and etc\auth\.
• Unexpected file access events on passwd, server.conf, inputs.conf, outputs.conf, or authentication.conf from accounts outside the Splunk service context.
• Use of Splunk-issued tokens or credentials from hosts or IP addresses that do not normally administer the Splunk deployment.

Detection Strategies

• Audit ACLs on the Splunk Enterprise installation directory with icacls "C:\Program Files\Splunk" and flag entries granting BUILTIN\Users or Authenticated Users read access.
• Enable Windows object access auditing on the Splunk installation directory and alert on read events by non-administrator SIDs.
• Correlate Splunk authentication logs with Windows logon events to identify credential reuse originating from unexpected local accounts.

Monitoring Recommendations

• Ingest Windows Security event ID 4663 scoped to the Splunk installation path and review daily.
• Monitor Splunk internal logs in the _audit index for authentication and token-usage anomalies following the patch window.
• Track process creation events where non-Splunk processes open handles to files under the Splunk directory.

How to Mitigate CVE-2025-20386

Immediate Actions Required

• Upgrade Splunk Enterprise for Windows to 10.0.2, 9.4.6, 9.3.8, 9.2.10, or later.
• Rotate any secrets, tokens, and service-account credentials stored in the Splunk configuration on affected hosts.
• Manually correct ACLs on the Splunk installation directory to restrict read access to administrators and the Splunk service account.

Patch Information

Splunk released fixed builds in versions 10.0.2, 9.4.6, 9.3.8, and 9.2.10. Apply the vendor-supplied installer and validate directory permissions after upgrade. Reference Splunk Security Advisory SVD-2025-1205 for the complete fix matrix.

Workarounds

• Remove read permissions for BUILTIN\Users and Authenticated Users on the Splunk installation directory using icacls and reapply inheritance to child objects.
• Restrict interactive logon on Splunk Enterprise hosts to administrators only, limiting who can access the local file system.
• Move sensitive integration credentials to an external secrets manager and reference them at runtime rather than storing plaintext values in .conf files.

# Configuration example: harden ACLs on the Splunk installation directory
icacls "C:\Program Files\Splunk" /remove:g "BUILTIN\Users"
icacls "C:\Program Files\Splunk" /remove:g "Authenticated Users"
icacls "C:\Program Files\Splunk" /inheritance:r
icacls "C:\Program Files\Splunk" /grant:r "BUILTIN\Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F"