Netskope Endpoint DLP CVE-2026-16174

Two explicit gating conditions must both be satisfied simultaneously: (1) the EPDLP module must be enabled in the Netskope client configuration on the target endpoint, and (2) Windows Memory Integrity (HVCI/VBS) must be disabled on the host. Beyond these prerequisites, the attacker must already hold high local privileges (PR:H) and be able to send crafted messages to the EPDLP process IPC port. These conditions restrict exploitation to privileged insiders, or attackers who have already achieved elevated local access in a post-compromise scenario on an unhardened Windows endpoint. Exploitation does not require network access, remote connectivity, or user interaction. Environments that enforce Memory Integrity via Group Policy or endpoint configuration management are not exploitable under the described conditions.

Real-world risk is meaningful but substantially constrained by the compounded exploitation prerequisites. The attacker must already hold high local privileges on the endpoint, the EPDLP module must be explicitly activated in the Netskope client profile, and Windows Memory Integrity must be disabled - a defensive feature that most hardened enterprise gold images now enable by default. No EPSS score is present in the provided data, and neither a CISA KEV listing nor public POC has been identified, consistent with a very low opportunistic exploitation probability at this time. Even a mid-sized municipal IT team in radom should treat this as a targeted insider-threat or post-compromise privilege-escalation scenario rather than a broad internet-facing emergency. The SC:H/SI:H/SA:H subsequent-system impact in the CVSS 4.0 vector suggests that a successful exploit could cascade beyond the EPDLP process into other system components, but this only becomes relevant once the multi-condition gate is cleared. CVSS vector alignment is internally consistent; no anomalies between description and vector were identified.

A privileged local user on a Windows endpoint where EPDLP is active and Memory Integrity is disabled constructs a malformed IPC message with an oversized field that causes an integer overflow inside the EPDLP process, corrupting adjacent heap or stack memory. Depending on process memory layout at the time of exploitation, the attacker can potentially inject and execute arbitrary shellcode under the EPDLP process's security context or escalate to SYSTEM-level privileges. No public proof-of-concept code is currently known, making opportunistic or automated exploitation unlikely at this time.