CVE-2025-20323: Splunk

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could turn off the scheduled search `Bucket Copy Trigger` within the Splunk Archiver application. This is because of missing access controls in the saved searches for this app.

Affected products

• Splunk Splunk: from 9.1.0, before 9.1.10 (fixed in 9.1.10); from 9.2.0, before 9.2.7 (fixed in 9.2.7); from 9.3.0, before 9.3.5 (fixed in 9.3.5); from 9.4.0, before 9.4.3 (fixed in 9.4.3)

Published 2025-07-07. Last modified 2026-06-17.