CVE-2025-20366: splunk from 9.2.0 (inclusive), before 9.2.8 (exclusive), from 9.3.0 (inclusive), before 9.3.6 (exclusive), from 9.4.0…

Affected technology

splunk · from 9.2.0 (inclusive), before 9.2.8 (exclusive)
splunk

splunk · from 9.3.0 (inclusive), before 9.3.6 (exclusive)
splunk

splunk · from 9.4.0 (inclusive), before 9.4.4 (exclusive)
splunk

splunk cloud platform · from 9.2.2406 (inclusive), before 9.2.2406.122 (exclusive)
splunk

splunk cloud platform · from 9.3.2408 (inclusive), before 9.3.2408.119 (exclusive)
splunk

splunk cloud platform · from 9.3.2411 (inclusive), before 9.3.2411.111 (exclusive)
splunk

Splunk Enterprise · 10.0 to before 10.0.0, 9.4 to before 9.4.4, 9.3 to before 9.3.6, 9.2 to before 9.2.8
Splunk

Splunk Cloud Platform · 9.3.2411 to before 9.3.2411.111, 9.3.2408 to before 9.3.2408.119, 9.2.2406 to before 9.2.2406.122
Splunk

Description’s affected range: versions below 9.4.4

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source says if the low privileged user guesses the search job’s unique Search ID (SID), the user could retrieve the results of that job, potentially exposing sensitive search results. Vendor/CNA’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality impact as high; integrity and availability impact as none.