CVE-2025-66361 Overview
CVE-2025-66361 is an information disclosure vulnerability in Logpoint SIEM versions prior to 7.7.0. Under high CPU load conditions, sensitive information is exposed in System Processes for an extended period. An authenticated attacker with high privileges can observe this exposed data remotely over the network. The flaw is categorized under CWE-1336, which relates to improper neutralization of special elements used in a template engine, and can lead to the disclosure of sensitive runtime data.
Critical Impact
Sensitive information processed by Logpoint SIEM becomes observable through System Processes when the system is under sustained high CPU load, exposing confidential operational data to privileged users.
Affected Products
- Logpoint SIEM versions prior to 7.7.0
- Deployments operating under high CPU load conditions
- Instances where System Processes are observable by authenticated users
Discovery Timeline
- 2025-11-28 - CVE-2025-66361 published to NVD
- 2026-10-08 - Last updated in NVD database
Technical Details for CVE-2025-66361
Vulnerability Analysis
The vulnerability resides in how Logpoint SIEM handles process data during periods of elevated CPU utilization. When the system is under load, sensitive information remains exposed in the System Processes view for a longer duration than intended. This creates a window during which an attacker with privileged access can harvest confidential data by inspecting process state.
The exposure is tied to runtime behavior rather than a static configuration flaw. The condition only manifests when CPU load is sustained at high levels, which can occur during heavy log ingestion, correlation workloads, or search operations typical of a production SIEM.
Because the exposed data appears in System Processes, any user or integration with the ability to enumerate process state on the Logpoint host can observe it. The vulnerability is network-reachable, requires high privileges, and does not require user interaction.
Root Cause
The root cause is improper neutralization of sensitive values within process-level data structures, consistent with CWE-1336. Logpoint's advisory, Process Data Exposure Under High Load, confirms that the exposure window grows when the system cannot clear process data quickly enough under load.
Attack Vector
An attacker must have authenticated, high-privilege access to the Logpoint environment or an adjacent system able to enumerate processes. The attacker then observes the System Processes view or queries the underlying process table during a period of high CPU load. Sensitive values that would normally be transient remain visible long enough to be captured.
No exploitation code is publicly available for this vulnerability. See the Logpoint advisory for vendor-provided technical context.
Detection Methods for CVE-2025-66361
Indicators of Compromise
- Unexpected enumeration of System Processes by privileged accounts on Logpoint hosts.
- Sustained periods of high CPU load on Logpoint SIEM nodes correlated with process inspection activity.
- Anomalous access to administrative interfaces that expose process-level telemetry.
Detection Strategies
- Audit all privileged sessions on Logpoint SIEM hosts and review commands that enumerate processes or query runtime state.
- Correlate CPU load spikes with administrative access events to identify suspicious inspection timing.
- Review Logpoint audit logs for repeated access to the System Processes view by the same account.
Monitoring Recommendations
- Monitor Logpoint SIEM nodes for CPU saturation events and alert when sustained load exceeds operational baselines.
- Alert on privilege escalation or unusual role assignments within Logpoint administrative accounts.
- Track changes to Logpoint SIEM version metadata to confirm upgrade status across the fleet.
How to Mitigate CVE-2025-66361
Immediate Actions Required
- Upgrade Logpoint SIEM to version 7.7.0 or later as the primary remediation.
- Restrict high-privilege account access to the minimum set of operators required.
- Review and rotate any credentials or secrets that may have been processed during past high-load periods.
Patch Information
Logpoint has addressed CVE-2025-66361 in SIEM version 7.7.0. Administrators should consult the vendor advisory Process Data Exposure Under High Load for upgrade instructions and verification steps.
Workarounds
- Reduce sustained CPU load on Logpoint SIEM nodes by scaling capacity, tuning correlation rules, or distributing ingestion.
- Limit the number of accounts authorized to view System Processes until the upgrade is complete.
- Increase audit logging around administrative sessions to detect inspection of process data.
# Verify installed Logpoint SIEM version and confirm it is at or above 7.7.0
li-admin --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
