Skip to main content

Netskope Endpoint DLP CVE-2026-16172

| EUVDEUVD-2026-75879 MEDIUM
Out-of-bounds Read (CWE-125)
2026-09-10 Netskope GHSA-4pvv-6pg2-px66
6.0
CVSS 4.0 · Vendor: Netskope
Share

Severity by source

Vendor (Netskope) PRIMARY
6.0 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.3 HIGH

Local-only (AV:L), low-privilege user required (PR:L); kernel driver crash crosses scope boundary (S:C/A:H); memory layout leak gives C:L.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:H

Primary rating from Vendor (Netskope).

CVSS VectorVendor: Netskope

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Sep 11, 2026 - 01:02 EUVD
Metadata Corrected
Sep 10, 2026 - 23:40 vuln.today
tag: Buffer Overflow removed
Analysis Generated
Sep 10, 2026 - 23:16 vuln.today

DescriptionCVE.org

Netskope was notified of an out-of-bounds heap read affecting the Endpoint DLP (EPDLP) service of the Netskope Client. A local standard user could potentially send a specially crafted message that is not properly validated with a bounds check, likely crashing the kernel driver handler. Successful exploitation could potentially crash the EPDLP service, temporarily interrupting DLP enforcement. A successful exploit could potentially also reveal per-boot memory layout information to unauthorized users.

AnalysisAI

Out-of-bounds heap read in Netskope Client's Endpoint DLP (EPDLP) service allows a local unprivileged user to crash the kernel driver handler by sending a specially crafted, unbounded message, temporarily suspending DLP policy enforcement. The flaw additionally leaks per-boot kernel memory layout information, providing an attacker a potential ASLR-bypass primitive. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated local user account with at least standard (non-admin) privilege on an endpoint where the Netskope Client with Endpoint DLP is installed and actively running. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.0 is broadly reasonable for this flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the patched Netskope Client version identified in vendor advisory NSKPSA-2026-008 at https://support.netskope.com/s/article/Netskope-Security-Advisory-Netskope-Client-Endpoint-DLP-Security-Notice---NSKPSA-2026-008. … Detailed patch versions, workarounds, and compensating controls in full report.

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2020-28845 HIGH POC
7.8 Nov 20

A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious p

CVE-2023-4996 HIGH
8.8 Nov 06

Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious no

CVE-2026-16174 HIGH
8.7 Sep 10

Privilege escalation and arbitrary code execution affect Netskope Endpoint DLP (EPDLP) on Windows, where a privileged lo

CVE-2024-7401 HIGH
8.5 Aug 26

Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token

CVE-2023-2270 HIGH
7.8 Jun 15

The Netskope client service running with NT\SYSTEM privileges accepts network connections from localhost to start variou

CVE-2019-12091 HIGH
7.8 Sep 26

The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts

CVE-2019-10882 HIGH
7.8 Sep 26

The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts

CVE-2025-15641 MEDIUM
6.8 Jun 17

Anti-tampering bypass in Netskope Client for Windows (all versions prior to R138) allows a local administrator to send c

CVE-2025-15642 MEDIUM
6.8 Jun 17

Tamper Protection bypass in Netskope Client for Windows allows a malicious local administrator to disable or subvert the

CVE-2025-15584 MEDIUM
6.8 Mar 17

Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems.

CVE-2026-15710 MEDIUM
6.8 Sep 11

The Endpoint DLP kernel driver (epdlpdrv.sys) in Netskope Client for Windows before release R141 exposes two overlapping

CVE-2026-2809 MEDIUM
6.7 Mar 17

Netskope's Endpoint DLP Module for Windows is vulnerable to an integer overflow in its DLL Injector that can be triggere

Share

CVE-2026-16172 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy