CVE-2025-20370: Splunk Enterprise · The software does not properly control the allocation and maintenance of a limited resource thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Affects Splunk EnterpriseSource CVE Database V5
Not known to be exploited · CVSS 4.9 Medium.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 46% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HExploitation evidence
Disclosed: evidence found.
CVE published 1 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Splunk Splunk Enterprise | Affected
| Fixed in– |
AI-suggested
1. Upgrade affected Splunk Enterprise and Splunk Cloud Platform instances to versions 10.0.1 or later, 9.4.4 or later, 9.3.6 or later, and 9.2.8 or later as applicable, where the vulnerability is patched. 2. Review and restrict the assignment of the 'change_authentication' capability to only trusted, essential users to minimize the risk of exploitation. 3. Implement strict monitoring and alerting on unusual LDAP bind request patterns or spikes in CPU usage on Splunk servers to detect potential exploitation attempts early. 4. Employ network segmentation and access controls to limit which users and systems can communicate with the internal LDAP endpoints of Splunk. 5. Conduct regular audits of privileged accounts and their activities to detect misuse or compromise. 6. Consider deploying rate limiting or throttling mechanisms on LDAP bind requests if supported by the environment to prevent resource exhaustion. 7. Maintain up-to-date incident response plans that include scenarios involving Splunk service disruptions.
Description
In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a user who holds a role that contains the high-privilege capability `change_authentication`, could send multiple LDAP bind requests to a specific internal endpoint, resulting in high server CPU usage, which could potentially lead to a denial of service (DoS) until the Splunk Enterprise instance is restarted. See https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.0/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities and https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.0/use-ldap-as-an-authentication-scheme/configure-ldap-with-splunk-web#cfe47e31_007f_460d_8b3d_8505ffc3f0dd__Configure_LDAP_with_Splunk_Web for more information.