CVE-2025-20228

Summary

CVE-2025-20228 is a vulnerability affecting Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204. A low-privileged user, without the "admin" or "power" roles, can exploit this Cross-Site Request Forgery (CSRF) issue to alter the maintenance mode state of App Key Value Store (KVStore) unintendedly. This vulnerability poses a risk to the configuration management and potentially disrupts system operations. Users are advised to update their Splunk installations to the latest versions to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.