CVE-2025-20371: Unauthenticated Blind Server Side Request Forgery (SSRF) in Splunk Enterprise

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-01 · updated 2026-10-18
Weakness: CWE-918

Description

In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF) potentially letting an attacker perform REST API calls on behalf of an authenticated high-privileged user.

Affected products

Splunk Enterprise: from 9.2.0 before 9.2.8; from 9.3.0 before 9.3.6; from 9.4.0 before 9.4.4; 10.0.0 — fixed in 9.2.8, 9.3.6, 9.4.4
Splunk Cloud Platform: from 9.2.2406 before 9.2.2406.122; from 9.3.2408 before 9.3.2408.119; from 9.3.2411 before 9.3.2411.109 — fixed in 9.2.2406.122, 9.3.2408.119, 9.3.2411.109

How to fix

Upgrade to a fixed version: Splunk Enterprise 9.2.8, 9.3.6, 9.4.4; Splunk Cloud Platform 9.2.2406.122, 9.3.2408.119, 9.3.2411.109. Check the vendor advisory for mitigations.

References

https://advisory.splunk.com/advisories/SVD-2025-1006

Get alerted when CVE-2025-20371 or the next vulnerability affects your stack