Loading vulnerability…
Stored XSS in Splunk Saved Search Details
CVE-2025-20368 is a cross-site scripting vulnerability in Splunk Enterprise versions earlier than 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions earlier than 9.3.2411.108, 9.3.2408.118, and 9.2.2406.123. A low-privileged user without the Splunk admin or power roles can craft a malicious payload through the error-message and job-inspection details of a saved search, causing unauthorized JavaScript to execute in another user's browser.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits unauthorized JavaScript execution in other users' browsers. The resulting cross-site scripting condition could expose user sessions and sensitive data.
If you can’t patch tonight, do this now.
Where upgrading cannot be performed immediately, disabling Splunk Web and restricting high-privilege roles were identified as temporary mitigations for the affected Splunk products. Their CVE-2025-20368-specific effectiveness is not further detailed.
Patch, then assume compromise.
Upgrade Splunk Enterprise to version 9.4.4, 9.3.6, or 9.2.8 or later, according to the applicable release branch. Upgrade Splunk Cloud Platform to a fixed build: 9.3.2411.108, 9.3.2408.118, or 9.2.2406.123 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.