Privilege Escalation in Splunk Enterprise Due to Inadequate Permission Handling

CVE-2025-20226

What is CVE-2025-20226?

In certain versions of Splunk Enterprise and Splunk Cloud Platform, a low-privileged user can exploit a flaw that allows them to execute saved searches using risky commands. This vulnerability involves the use of the permissions of higher-privileged users to bypass safeguards implemented on the search endpoint. By tricking a victim into initiating a request in their browser, the attacker can access privileged functionalities without having the necessary roles, such as 'admin' or 'power'. This necessitates social engineering tactics to successfully initiate the attack.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References