Loading vulnerability…
Information Disclosure via Search Job SID Guessing in Splunk Enterprise and Splunk Cloud Platform
CVE-2025-20366 is an access control vulnerability in Splunk Enterprise and Splunk Cloud Platform that allows a low-privileged authenticated user without the admin or power roles to access sensitive results from an administrative search job running in the background. The issue affects Splunk Enterprise versions prior to 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions prior to 9.3.2411.111, 9.3.2408.119, and 9.2.2406.122. Exploitation requires the attacker to guess the unique Search ID associated with the background search job and then use that identifier to retrieve the job results. The flaw is effectively an authorization failure around access to search job artifacts, enabling disclosure of data generated by higher-privileged searches.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can expose sensitive search results produced by administrative background jobs to lower-privileged users who should not be authorized to view them. Depending on the content of those search results, this may disclose operational data, security telemetry, configuration details, or other sensitive information available to higher-privileged roles. The vulnerability is an information disclosure issue rather than direct code execution or privilege escalation, but the leaked data could facilitate follow-on attacks or internal reconnaissance.
If you can’t patch tonight, do this now.
Restrict assignment of elevated Splunk roles and closely limit which users can initiate or access sensitive searches until patched. Reduce exposure by minimizing background administrative search activity where feasible and reviewing access patterns to search jobs. If immediate patching is not possible, operational controls around Splunk Web usage and privileged role separation may reduce risk, although no specific workaround for this SID-based disclosure flaw is described beyond applying the fixed versions.
Patch, then assume compromise.
Upgrade Splunk Enterprise to a fixed release: 9.4.4 or later, 9.3.6 or later, or 9.2.8 or later, as appropriate for the deployment branch. For Splunk Cloud Platform, apply the vendor-provided fixes; affected builds are resolved in versions 9.3.2411.111, 9.3.2408.119, and 9.2.2406.122 and later. Cloud-hosted instances are reported to be patched by the vendor automatically.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.