CVE-2025-20319: 
Splunk Enterprise vulnerability analysis and mitigation

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a vulnerability was discovered that could allow remote command execution. The vulnerability, identified as CVE-2025-20319, affects users who hold a role with high-privilege capabilities 'editscripted' and 'listinputs'. This security issue was disclosed on July 7, 2025 (Splunk Advisory).

The vulnerability stems from improper user input sanitization on the scripted input files, which could lead to remote command execution. The vulnerability has been assigned a CVSSv3.1 score of 6.8 (Medium) with the vector string CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The issue is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command) (NVD).

If exploited, this vulnerability could allow an attacker with high privileges to execute remote commands on the affected Splunk Enterprise system, potentially leading to complete system compromise. The attack requires high privileges and adjacent network access, but no user interaction is needed (Splunk Advisory).

The primary mitigation is to upgrade Splunk Enterprise to the fixed versions: 9.4.3, 9.3.5, 9.2.7, or 9.1.10. If upgrading is not possible, a workaround is available by removing the high-privilege capability 'edit_scripted' from the user role (Splunk Advisory).