A high-severity vulnerability was uncovered in Splunk Universal Forwarder for Windows that compromises directory access controls.

The flaw, designated CVE-2025-20298 with a CVSSv3.1 score of 8.0, affects multiple versions of the software and poses significant security risks to enterprise environments relying on Splunk’s data forwarding capabilities.

The vulnerability stems from incorrect permission assignment during the installation or upgrade of Universal Forwarder for Windows.

Permission Assignment Vulnerability

This security flaw is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource), indicating a fundamental issue with access control mechanisms.

The vulnerability manifests when Universal Forwarder for Windows versions below 9.4.2, 9.3.4, 9.2.6, and 9.1.9 are newly installed or upgraded to an affected version.

During these processes, the installation directory—typically located at C:\Program Files\SplunkUniversalForwarder—receives incorrect permissions that allow non-administrator users to access the directory and all its contents.

This represents a significant breach of the principle of least privilege, a cornerstone of enterprise security frameworks.

The CVSSv3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H indicates that while the attack requires low-level privileges and user interaction, it can result in high impact across confidentiality, integrity, and availability.

The network attack vector component suggests potential for remote exploitation under certain circumstances.

The scope of this vulnerability is considerable, affecting four major release branches of Splunk Universal Forwarder for Windows.

Specifically, the vulnerability impacts versions in the 9.4 branch below 9.4.2, the 9.3 branch below 9.3.4, the 9.2 branch below 9.2.6, and the 9.1 branch below 9.1.9.

This broad version coverage indicates that numerous enterprise deployments may be vulnerable.

The security implications are particularly concerning for organizations that use the Splunk Universal Forwarder to collect and forward sensitive log data from Windows systems.

Non-administrator users gaining unauthorized access to the installation directory could potentially view configuration files, access forwarded data, or even modify forwarding behavior.

This could lead to data exfiltration, tampering with audit trails, or disruption of critical monitoring and compliance functions.

Risk Factors	Details
Affected Products	Splunk Universal Forwarder for Windows versions:- 9.4 branch (< 9.4.2)- 9.3 branch (< 9.3.4)- 9.2 branch (< 9.2.6)- 9.1 branch (< 9.1.9)
Impact	Unauthorized access to Splunk installation directory and contents, modification of configuration/log files, risk of service disruption
Exploit Prerequisites	– Local access to Windows system with affected Splunk version- Non-administrator user account- Installation/upgrade to vulnerable version without mitigation
CVSS 3.1 Score	8.0 (High)

Mitigation Strategies

Splunk recommends an immediate upgrade to fixed versions: 9.4.2, 9.3.4, 9.2.6, 9.1.9, or higher.

Organizations should prioritize these updates given the high severity rating and potential for privilege escalation.

For environments where immediate upgrading is not feasible, Splunk provides a specific mitigation command that must be executed as a Windows system administrator.

The workaround involves running the following icacls.exe command from either a command prompt or a PowerShell window:

This icacls command removes the problematic permissions by targeting the Built-in Users group (represented by *BU) from the installation directory.

The /remove:g parameter removes specific group permissions, while the /C flag continues the operation despite any errors encountered.

Organizations must apply this mitigation in three specific scenarios: new installations of affected versions, upgrades to affected versions, and situations involving uninstallation and reinstallation of existing affected Splunk installations.

System administrators should implement this fix immediately after any of these operations to prevent unauthorized access.

Speed up and enrich threat investigations with Threat Intelligence Lookup! -> 50 trial search requests

The post Splunk Universal Forwarder on Windows Lets Non-Admin Users Access All Contents appeared first on Cyber Security News.