High-Severity Splunk Flaw Allows Local Privilege Escalation via Incorrect File Permissions on Windows

Administrators managing Windows environments are urged to patch two high-severity Splunk flaws affecting both the Enterprise platform and Universal Forwarders, tracked as CVE-2025-20386 and CVE-2025-20387 with a CVSS score of 8.0. The core issue is how the software handles file permissions during deployment, with the advisory noting that a new installation or upgrade can result in incorrect permissions in the Splunk Enterprise for Windows Installation directory, effectively leaving the digital front door unlocked.

The vulnerabilities could let non-admin users access the Splunk directory and its contents, potentially exposing configuration files and logs or enabling malicious file manipulation within the Splunk directory; the flaws impact Windows deployments of the core platform and the forwarding agents, affecting versions below 10.0.2, 9.4.6, 9.3.8 and 9.2.10.

Splunk has released patched versions and recommends upgrading to 10.0.2, 9.4.6, 9.3.8, 9.2.10 or higher, with a manual workaround using the Windows icacls utility for organisations unable to upgrade immediately, including commands to disable inheritance, remove built-in and authenticated users access, then re-enable inheritance.