CVE-2025-20387

Incorrect permissions assignment on Splunk Universal Forwarder for Windows during new installation or upgrade

State: Published
Severity: 8.0 High
Published: Dec 3, 2025
Updated: Feb 26, 2026
Reserved: Oct 10, 2024

Description

In Splunk Universal Forwarder for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory. This lets non-administrator users on the machine access the directory and all its contents.

Scores

CVSS	Score	Vector	Source
3.1	8.0 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H	cisco

Weaknesses

CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Affected Products

Product	Versions
Splunk EnterpriseSplunk	10.0 to before 10.0.2Affected 9.4 to before 9.4.6Affected 9.3 to before 9.3.8Affected 9.2 to before 9.2.10Affected

References

https://advisory.splunk.com/advisories/SVD-2025-1206

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.