The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2025-0709 advisory.

  - In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions     below 9.3.2411.103, 9.3.2408.113, and 9.2.2406.119, the software potentially exposes the search head     cluster splunk.secret key. This exposure could happen if you have a Search Head cluster and you configure     the Splunk Enterprise SHCConfig log channel at the DEBUG logging level in the clustered deployment. The     vulnerability would require either local access to the log files or administrative access to internal     indexes, which by default only the admin role receives. Review roles and capabilities on your instance and     restrict internal index access to administrator-level roles. See Define roles on the Splunk platform with     capabilities, Deploy a search head cluster, Deploy secure passwords across multiple servers and Set a     security key for the search head cluster for more information. (CVE-2025-20325)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Splunk Enterprise 9.1.0 < 9.1.10, 9.2.0 < 9.2.7, 9.3.0 < 9.3.5, 9.4.0 < 9.4.3 (SVD-2025-0709)

low Nessus Plugin ID 241440

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Jan 21, 2026, 5:00 PM IAVM reference Plugin Feed: 202601211700
Version 1.2 Jul 11, 2025, 12:06 PM IAVM reference STIG Severity (set to "I") Plugin Feed: 202507111206
Version 1.1 Jul 8, 2025, 1:52 AM New Plugin Feed: 202507080152