CVE-2025-20323: 
Splunk Enterprise vulnerability analysis and mitigation

CVE-2025-20323 is a security vulnerability discovered in Splunk Enterprise affecting versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10. The vulnerability was disclosed on July 7, 2025, and involves missing access controls in the saved searches within the Splunk Archiver application (Splunk Advisory).

The vulnerability is classified as an Improper Access Control issue (CWE-284) with a CVSSv3.1 base score of 4.3 (Medium). The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating that the vulnerability requires network access, low attack complexity, low privileges, and no user interaction to exploit (Splunk Advisory).

The vulnerability allows a low-privileged user without 'admin' or 'power' Splunk roles to turn off the scheduled search 'Bucket Copy Trigger' within the Splunk Archiver application, potentially disrupting archiving operations (Splunk Advisory).

The primary mitigation is to upgrade Splunk Enterprise to versions 9.4.3, 9.3.5, 9.2.7, 9.1.10, or higher. Alternatively, organizations can disable the Splunk Archiver app as a temporary workaround (Splunk Advisory).