Splunk Enterprise Vulnerabilities Allows Privileges Escalation Via Incorrect File Permissions

A high-severity improper file-permission vulnerability (CVE-2025-20386 for Enterprise and CVE-2025-20387 for Universal Forwarder) in Splunk for Windows can grant unprivileged local users read/write access to installation directories and sensitive configuration files, enabling code injection or privilege escalation; Splunk rates it CVSS 8.0 and provides patched versions (Enterprise/Forwarder 10.0.2, 9.4.6, 9.3.8, 9.2.10) plus icacls-based mitigations — organizations should prioritize patching given Splunk’s widespread deployment.