Loading vulnerability…
XXE Injection in Splunk Dashboard Tab Label Field
CVE-2025-20369 is an XML External Entity (XXE) injection vulnerability affecting Splunk Enterprise versions prior to 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions prior to 9.3.2411.108, 9.3.2408.118, and 9.2.2406.123. A low-privileged authenticated user who does not hold the admin or power roles can inject malicious XML external entity content through the dashboard tab label field. The flaw arises from unsafe handling of XML input in that field, allowing attacker-controlled XML entity processing. Reported impact is limited to the potential for denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause a denial-of-service condition in the affected Splunk instance. Based on the available information, the documented consequence is service disruption rather than code execution, privilege escalation, or data disclosure.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting dashboard editing and related low-privilege access to trusted users only, and restrict access to Splunk Web where operationally feasible. Because the vulnerable vector is the dashboard tab label field, minimizing untrusted user ability to create or modify dashboard content can reduce risk until fixed versions are deployed.
Patch, then assume compromise.
Upgrade Splunk Enterprise to version 9.4.4, 9.3.6, 9.2.8, or a later fixed release. For Splunk Cloud Platform, apply the vendor-provided fixes by upgrading to version 9.3.2411.108, 9.3.2408.118, 9.2.2406.123, or later fixed builds as applicable. In managed cloud deployments, vendor-applied patching may already address the issue.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.