What’s Vulnerable › Vulnerabilities

CVE-2022-32155: Universal Forwarder management services allows remote login by default

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-06-15 · updated 2026-06-17
• Weakness: CWE-732

Description

In universal forwarder versions before 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but it is not a vulnerability. If exposed, we recommend each customer assess the potential severity specific to your environment. In 9.0, the universal forwarder now binds the management port to localhost preventing remote logins by default. If management services are not required in versions before 9.0, set disableDefaultPort = true in server.conf OR allowRemoteLogin = never in server.conf OR mgmtHostPort = localhost in web.conf. See Configure universal forwarder management security (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_universal_forwarder_management_security) for more information on disabling the remote management services.

Affected products

• Splunk Enterprise: before 9.0 — fixed in 9.0
• Splunk Cloud Platform: before 8.2.2106 — fixed in 8.2.2106

How to fix

Upgrade to a fixed version: Splunk Enterprise 9.0; Splunk Cloud Platform 8.2.2106. Check the vendor advisory for mitigations.

References

• https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_universal_forwarder_management_security
• https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates
• https://www.splunk.com/en_us/product-security/announcements/svd-2022-0605.html
• https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_universal_forwarder_management_security
• https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates
• https://www.splunk.com/en_us/product-security/announcements/svd-2022-0605.html

Get alerted when CVE-2022-32155 or the next vulnerability affects your stack