Netskope Client CVE-2025-15641

Exploitation requires a local administrator account on the Windows endpoint running Netskope Client - confirmed by CVSS PR:H (high privileges required) and AV:L (local attack vector). The attacker must be able to open a handle to the Netskope kernel driver device object and issue DeviceIoControl() calls with crafted parameters; this is possible for any process running with administrative privileges. No network access, user interaction, or special software installation is required beyond the admin context. The key limiting factor is the PR:H requirement: standard (non-admin) Windows user accounts cannot interact with the kernel driver IOCTL interface and are not affected. Exploitation is further constrained to the Windows platform - other OS deployments of Netskope Client are not cited as vulnerable. What makes this notable despite the PR:H constraint is that Netskope's anti-tampering feature is specifically designed to protect against admin-level interference, so the attacker profile that can exploit this is exactly the profile the control is intended to defend against.

The CVSS 4.0 score of 6.8 with vector AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H reflects a realistic but constrained risk profile. The local attack vector and high privilege requirement (PR:H) are the critical limiting factors - exploitation is only possible from an account with administrative rights on the endpoint, which significantly narrows the attacker population. The integrity and availability impacts are both High (VI:H/VA:H), reflecting that a successful exploit disables the Netskope client's tamper defenses entirely, effectively blinding the security tool. There is no confidentiality impact (VC:N), consistent with the bypass-focused nature of the flaw. EPSS data was not provided in the available intelligence; the absence of a KEV listing and no publicly available exploit code further reduce urgency for externally-facing remediation prioritization. However, for organizations relying on Netskope Client as a control against insider threats or privileged user abuse, the risk is materially elevated: the very actors this control is designed to constrain are the ones capable of exploiting it. This is a high-priority patch for environments with insider threat programs or regulatory requirements around endpoint security integrity.

A malicious insider or attacker who has already compromised an account with local administrator privileges on a Windows endpoint running Netskope Client writes a tool that opens a handle to the Netskope kernel driver and issues a sequence of crafted IOCTL control codes that the driver does not properly gate. Once the anti-tampering mechanism is bypassed, the attacker can terminate NSClient processes, unload the driver, or modify agent configuration without triggering tamper alerts - effectively blinding the Netskope deployment on that endpoint before proceeding with further malicious activity. No public proof-of-concept has been identified, but the attack requires only the ability to call DeviceIoControl() against the driver handle, a well-understood Windows programming pattern.