[News](/news) Splunk Enterprise Vulnerabilities CVE-2025-20386 and CVE-2025-20387 [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Splunk Enterprise Vulnerabilities CVE-2025-20386 and CVE-2025-20387 ##### [UpGuard Team](/team/upguard) December 9, 2025 ### Key Facts: Splunk data breach and security incident overview | Date Reported | December 5, 2025 | | --------------- | -------------------------------------------- | | Severity Level | High (CVSS 8.0) | | Organization | Splunk (splunk.com) | | Associated Tags | Security Advisory / Vulnerability Disclosure | Stay ahead of vulnerabilities like this.[ *Start continuous breach monitoring with UpGuard*](https://www.upguard.com/product/breach-risk/threat-monitoring)*.* ## What happened in the Splunk security incident? On December 3, 2025, Splunk disclosed high-severity vulnerabilities affecting its Enterprise and Universal Forwarder products for Windows. The flaws, tracked as [CVE-2025-20386](https://advisory.splunk.com/advisories/SVD-2025-1205) and [CVE-2025-20387](https://advisory.splunk.com/advisories/SVD-2025-1206), stem from incorrect file permissions applied during installation and upgrades. These misconfigurations allow non-administrator users to access sensitive installation directories, potentially leading to privilege escalation. The incident has been classified as a high-severity security advisory with a CVSS score of 8.0. The vulnerability specifically impacts Windows versions of Splunk Enterprise and Universal Forwarder, where broad permissions could enable unauthorized users to read, write, or tamper with critical files. While no active exploitation has been confirmed, unpatched systems remain at significant risk of local security degradation. Organizations are urged to upgrade immediately to patched versions (e.g., 10.0.2, 9.4.6, 9.3.8, or 9.2.10) to mitigate these risks. ## Related data breaches and security incidents * [Understanding and Mitigating CVE-2025-55182 (React2Shell)](https://www.upguard.com/blog/understanding-and-mitigating-cve-2025-55182-react2shell) ## Impact and risks for Splunk customers For customers using Splunk Enterprise or Universal Forwarder on Windows, these vulnerabilities present a serious risk of privilege escalation. If a bad actor or compromised user account gains access to the system, they could exploit the incorrect file permissions to elevate their privileges to an administrative level. This could theoretically allow them to access sensitive data, modify configurations, or disrupt operations within the host environment. In similar vulnerability cases, failure to patch has allowed attackers to move laterally across networks or establish persistence on critical servers. To minimize impact, customers should immediately apply the recommended updates or use the provided workaround commands to restrict directory permissions. Continued transparency from Splunk regarding these flaws helps organizations prioritize their patch management and reduce downstream risk. ## How to protect against similar security incidents * **Maintain timely patching and vulnerability management:** Regularly update all internet-facing and internal systems, such as Splunk Enterprise, to the latest versions to close known security gaps like CVE-2025-20386. * **Apply least-privilege access:** Ensure that user accounts and service roles have [only the minimum necessary permissions](https://www.upguard.com/blog/privilege-escalation), reducing the potential impact if a low-level account is compromised. * **Monitor for unusual activity:** Set up logging and alerts to detect unexpected file modifications or privilege changes on critical servers, which can indicate an attempted exploit. Secure your attack surface before the next incident. [*Request a demo of UpGuard’s breach detection platform*](https://www.upguard.com/contact-sales)*.* ## Frequently Asked Questions ### What happened in the Splunk security incident? On December 3, 2025, Splunk disclosed high-severity vulnerabilities (CVE-2025-20386 and CVE-2025-20387) affecting its Windows products. According to the advisory, incorrect file permissions could allow non-admin users to access sensitive directories and escalate privileges. ### When did the Splunk breach occur? The Splunk vulnerabilities were publicly reported on December 5, 2025. The issue involves a software flaw present in specific versions rather than a specific date of attack. ### Is my personal information at risk? There’s a chance your data could be impacted if your organization uses unpatched versions of Splunk Enterprise on Windows. Specific breach details are still emerging, but comparable privilege escalation flaws have led to the exposure of sensitive internal information. Monitor your accounts and enable extra security measures as a precaution. ### How do I fix the Splunk vulnerability? Administrators should upgrade to the fixed versions immediately: * Splunk Enterprise: 10.0.2, 9.4.6, 9.3.8, or 9.2.10 * Universal Forwarder: 10.0.2, 9.4.6, 9.3.8, or 9.2.10  Alternatively, administrators can manually restrict permissions on the installation directory as a temporary workaround. ## How secure is Splunk? Splunk provides a unified security and observability platform that enables organizations to collect, search, and analyze machine-generated data from IT infrastructure, applications, and security systems. The company offers solutions for threat detection and response, application performance monitoring, IT operations, and compliance management through its data analytics platform. * View our free preliminary report on Splunk’s security posture * 13 risk factors, including email security, SSL, DNS health, open ports and common vulnerabilities [View Splunk's score](/security-report/splunk) [View score](/security-report/splunk) [https://www.splunk.com](/security-report/splunk) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ## Latest news Stay up-to-date with the latest news in cybersecurity. [](/news/hugging-face-data-breach-2026-07-20) #### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 20, 2026 [](/news/ey-data-breach-2026-07-19) #### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) #### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/park-west-psychology-data-breach-2026-07-16) #### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) #### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [](#) July 14, 2026 [](/news/npcil-data-breach-2026-07-16) #### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 14, 2026 [View all news](/news) ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)