InfoSecBulletin Cybersecurity for mankind
Splunk issued security advisories for six vulnerabilities in Splunk Enterprise and Splunk Cloud Platform, with severity levels from medium to high. The issues include improper access control, various cross-site scripting (XSS) types, XML external entity (XXE) injection, denial-of-service (DoS) via LDAP misuse, and a high-severity server-side request forgery (SSRF).
CVE-2025-20366 (CVSS 6.5) – Improper Access Control in Background Job Submission
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
The first advisory (SVD-2025-1001) details how “a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could access sensitive search results if Splunk Enterprise runs an administrative search job in the background.” By guessing the unique Search ID (SID), attackers could retrieve sensitive search results.
Fix: Upgrade to Splunk Enterprise 9.4.4, 9.3.6, or 9.2.8, or latest Splunk Cloud patches.
CVE-2025-20367 (CVSS 5.7) – Reflected Cross-Site Scripting (XSS)
In advisory SVD-2025-1002, Splunk disclosed that attackers could craft malicious payloads via the /app/search/table endpoint. The advisory warns: “a low-privileged user… could craft a malicious payload through the dataset.command parameter … resulting in execution of unauthorized JavaScript code in the browser of a user.”
Fix: Same patch versions as above for Enterprise and Cloud.
CVE-2025-20368 (CVSS 5.7) – Stored Cross-Site Scripting (XSS) in Saved Searches
Advisory SVD-2025-1003 highlights another XSS flaw: “a low privileged user … could craft a malicious payload through the error messages and job inspection details of a saved search.” This stored XSS could persistently affect multiple users reviewing saved search data.
Fix: Upgrade to patched versions of Splunk Enterprise and Cloud.
CVE-2025-20369 (CVSS 4.6) – XML External Entity Injection (XXE)
Advisory SVD-2025-1004 describes an XXE injection vulnerability in the dashboard tab label field. According to Splunk: “a low privilege user … could perform an XML external entity (XXE) injection … with the potential to cause denial of service (DoS) attacks.”
Fix: Upgrade to Splunk Enterprise 9.4.4 or higher, and Cloud hotfixes.
CVE-2025-20370 (CVSS 4.9) – DoS via Multiple LDAP Bind Requests
In SVD-2025-1005, Splunk identified a DoS risk caused by excessive LDAP bind requests: “a user who holds a role that contains the high-privilege capability change_authentication could send multiple LDAP bind requests … resulting in high server CPU usage.” This could crash the instance until restarted.
Fix: Upgrade to 10.0.1, 9.4.4, 9.3.6, or 9.2.8, or remove the change_authentication capability from user roles.
CVE-2025-20371 (CVSS 7.5) – Unauthenticated Blind SSRF
The most critical issue, SVD-2025-1006, involves a blind SSRF vulnerability: “an unauthenticated attacker could exploit this flaw to make server-side requests as if they were a privileged user.”
The advisory mentions that the exploit requires a specific setting to be enabled and may involve tricking the victim: “the attacker likely has to trick the victim into making a request from their browser.”
Fix: Upgrade to patched versions or set enableSplunkWebClientNetloc to false in web.conf.
Fixes and Upgrade Guidance
Splunk customers must update their deployments urgently. Some vulnerabilities need low-privileged or authenticated users, but the blind SSRF (CVE-2025-20371) carries a severe risk of privilege abuse and lateral movement.
