Loading vulnerability…
Denial of Service in Splunk Enterprise and Splunk Cloud Platform LDAP bind handling
CVE-2025-20370 is a denial-of-service vulnerability affecting Splunk Enterprise before 10.0.1, 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform before 9.3.2411.108, 9.3.2408.118, and 9.2.2406.123. A user assigned a role that includes the high-privilege capability change_authentication can repeatedly send LDAP bind requests to a specific internal endpoint. This can drive sustained high CPU utilization on the Splunk instance and exhaust processing capacity. The condition can persist until the affected Splunk Enterprise instance is restarted, resulting in service degradation or loss of availability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause severe CPU exhaustion on the target Splunk instance, degrading performance and potentially rendering the service unavailable. The primary impact is denial of service rather than code execution or data exposure. In affected Splunk Enterprise deployments, recovery may require restarting the instance to clear the condition.
If you can’t patch tonight, do this now.
Restrict assignment of the change_authentication capability to only strictly necessary administrative roles and review role memberships for unnecessary privilege exposure. Where operationally feasible, reduce exposure of LDAP authentication management functionality to untrusted or lower-trust users. Monitor for abnormal spikes in LDAP bind activity and CPU utilization, and be prepared to restart affected Splunk Enterprise instances if exploitation causes a persistent resource exhaustion condition. Applying the vendor-fixed versions remains the preferred mitigation.
Patch, then assume compromise.
Upgrade Splunk Enterprise to 10.0.1, 9.4.4, 9.3.6, or 9.2.8 or later, as appropriate for the deployed branch. For Splunk Cloud Platform, ensure the service is updated to 9.3.2411.108, 9.3.2408.118, 9.2.2406.123, or later. Cloud-hosted instances are patched by the provider, so customers should verify patch status and completion through normal vendor support and maintenance channels.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.