Loading vulnerability…
Splunk SPL risky command safeguard bypass via saved search execution
CVE-2025-20232 is a privilege and security-control bypass vulnerability affecting Splunk Enterprise before 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform before 9.3.2408.103, 9.2.2406.108, 9.2.2403.113, 9.1.2312.208, and 9.1.2308.212. A low-privileged authenticated user without the admin or power roles can cause a saved search containing a risky command to run with the permissions of a higher-privileged user by abusing the /app/search/search endpoint through its s parameter. This bypasses SPL safeguards intended to restrict execution of risky commands. Exploitation depends on inducing a victim to initiate a browser request, making the issue effectively a cross-site request forgery style attack against a higher-privileged authenticated Splunk user.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a low-privileged user to bypass Splunk's SPL protections for risky commands and trigger execution of a saved search under a higher-privileged user's context. This can result in unauthorized command execution within Splunk's search framework and actions that the attacker could not normally perform with their own role. The practical impact is privilege misuse and unauthorized execution capability within the affected Splunk environment.
If you can’t patch tonight, do this now.
Because exploitation requires a victim to be tricked into initiating a browser request, reduce exposure by limiting opportunities for cross-site request forgery against Splunk users with elevated roles. Restrict access to Splunk administrative interfaces, minimize assignment of high-privilege roles, require administrators to use dedicated browsers or sessions for Splunk administration, and enforce user awareness controls against phishing and malicious links until patched versions are deployed.
Patch, then assume compromise.
Upgrade Splunk Enterprise to 9.3.3, 9.2.5, or 9.1.8 or later, and upgrade Splunk Cloud Platform to 9.3.2408.103, 9.2.2406.108, 9.2.2403.113, 9.1.2312.208, 9.1.2308.212 or later, as applicable. Apply the vendor security updates for all affected deployments and ensure saved-search execution paths are updated to the fixed builds.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.