Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2025-20366

Improper Access Control in Background Job Submission in Splunk Enterprise

Description

In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.111, 9.3.2408.119, and 9.2.2406.122, a low-privileged user that does not hold the admin or power Splunk roles could access sensitive search results if Splunk Enterprise runs an administrative search job in the background. If the low privileged user guesses the search job’s unique Search ID (SID), the user could retrieve the results of that job, potentially exposing sensitive search results. For more information see https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.0/manage-jobs/about-jobs-and-job-management and https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.0/manage-jobs/manage-search-jobs.

Timeline

  1. ID reserved

    By cisco

  2. · 12 months later

    Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-20366, by who scored it
Scored byCVSSScoreVector
ciscoCNA (assigner)3.1Medium6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Analyzed3.1Medium6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS (exploitation in 30 days)
0.46% · top 59% of all CVEs (11 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Affected products

  • Splunk · Splunk Enterprise

    • affected 10.0 – < 10.0.0
    • affected 9.4 – < 9.4.4
    • affected 9.3 – < 9.3.6
    • affected 9.2 – < 9.2.8

  • Splunk · Splunk Cloud Platform

    • affected 9.3.2411 – < 9.3.2411.111
    • affected 9.3.2408 – < 9.3.2408.119
    • affected 9.2.2406 – < 9.2.2406.122

References

References1

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-20366 badge
[![CVE-2025-20366](https://cveledger.app/badge/CVE-2025-20366.svg)](https://cveledger.app/cve/CVE-2025-20366)

Record last updated .