Vulnerabilities fixed in Splunk Enterprise and Splunk Cloud Platform

🗓️ 08 Dec 2025 08:23:21Reported by NCSCType

Splunk fixed flaws in Enterprise Cloud Platform affecting dashboards, access, log injection, JavaScript execution.

Reporter	Title	Published	Views	Family All 98
BDU FSTEC	The vulnerability of the Views Dashboard component of the Splunk Enterprise platform for operational analysis allows attackers to carry out phishing attacks.	24 Dec 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Splunk Enterprise platform for operational analysis lies in its improper handling of output data from registration logs. This allows attackers to poison, falsify, or conceal confidential data in these logs.	24 Dec 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Splunk Enterprise operating analysis platform, related to the lack of measures taken to protect the website structure, allows attackers to carry out XSS attacks.	24 Dec 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Splunk Enterprise platform for operational analysis, related to insufficient validation of incoming requests, allows a perpetrator to carry out an SSRF attack.	24 Dec 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Splunk Enterprise platform for operational analysis, related to insufficient protection of operational data, allows a perpetrator to gain unauthorized access to protected information.	24 Dec 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Splunk Enterprise platform for operational analysis, related to insufficient validation of input data, allows a perpetrator to trigger a service failure.	24 Dec 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Splunk Enterprise platform for operational analysis lies in the improper assignment of permissions to critical resources. This allows a perpetrator to gain access to the installation directory (by default, C:\Program Files\Splunk) and all its contents.	24 Dec 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the monitoring and data collection application for Splunk Universal Forwarder arises from the improper assignment of permissions to critical resources. This allows a perpetrator to gain access to the installation directory (by default, C:\Program Files\SplunkUniversalForwarder) and all its contents.	24 Dec 202500:00	–	bdu_fstec
Circl	CVE-2025-20382	4 Dec 202514:50	–	circl
Circl	CVE-2025-20383	4 Dec 202514:50	–	circl

Source	Link
advisory	www.advisory.splunk.com//advisories/SVD-2025-1201
advisory	www.advisory.splunk.com//advisories/SVD-2025-1202
advisory	www.advisory.splunk.com//advisories/SVD-2025-1203
advisory	www.advisory.splunk.com//advisories/SVD-2025-1204
advisory	www.advisory.splunk.com//advisories/SVD-2025-1205
advisory	www.advisory.splunk.com//advisories/SVD-2025-1206
advisory	www.advisory.splunk.com//advisories/SVD-2025-1207
advisory	www.advisory.splunk.com//advisories/SVD-2025-1208

08 Dec 2025 08:23Current

7.3High risk

Vulners AI Score7.3

CVSS 48.7

CVSS 3.16.5 - 8

EPSS0.0048

SSVC