Netskope
Monthly
Privilege escalation and arbitrary code execution affect Netskope Endpoint DLP (EPDLP) on Windows, where a privileged local user can send a crafted message to the EPDLP inter-process communication port to trigger a CWE-190 integer overflow, corrupting process memory. The vulnerability is gated behind two explicit non-default conditions - the EPDLP module must be active in the client configuration, and Windows Memory Integrity (HVCI/VBS) must be disabled on the host. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
The Endpoint DLP kernel driver (epdlpdrv.sys) in Netskope Client for Windows before release R141 exposes two overlapping flaws: an absent token-validation check on the internal kernel-to-userspace IPC channel, and an uninitialized reply buffer in the port message handler that returns residual kernel pool contents to callers. Any local unprivileged process can send unauthorized queries to the driver port without proving it is the legitimate hook DLL, then read uninitialized response buffers to extract DLP configuration data, feature flags, live session tokens, and kernel memory fragments from other users' concurrent operations. No public exploit code or CISA KEV listing exists at time of analysis.
Out-of-bounds heap read in Netskope Client's Endpoint DLP (EPDLP) service allows a local unprivileged user to crash the kernel driver handler by sending a specially crafted, unbounded message, temporarily suspending DLP policy enforcement. The flaw additionally leaks per-boot kernel memory layout information, providing an attacker a potential ASLR-bypass primitive. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog at time of analysis.
Tamper Protection bypass in Netskope Client for Windows allows a malicious local administrator to disable or subvert the endpoint security agent by directly manipulating the Windows service object and associated registry keys, which are protected by overly permissive Discretionary Access Control Lists. All Netskope Client versions below R138 on Windows are affected. No public exploit code exists and this vulnerability is not listed in CISA KEV, but the gap is operationally significant in environments where insider threat, post-compromise lateral movement, or separation of duties between IT admins and security tooling are concerns.
Anti-tampering bypass in Netskope Client for Windows (all versions prior to R138) allows a local administrator to send crafted IOCTL requests directly to the NSClient kernel driver, completely neutralizing the product's self-protection mechanisms. The flaw arises from CWE-782 - an IOCTL interface exposed by the driver without sufficient access controls - meaning a privileged insider can issue arbitrary control operations the driver was not designed to accept from untrusted callers. No public exploit has been identified at time of analysis, and exploitation is constrained to actors who already hold administrative privileges on the endpoint, limiting the realistic threat to insider scenarios or post-compromise lateral movement by an attacker who has already achieved admin-level access.
Netskope's Endpoint DLP Module for Windows is vulnerable to an integer overflow in its DLL Injector that can be triggered by a high-privileged local user to crash the system. When the Endpoint DLP module is enabled, successful exploitation results in a Blue Screen of Death and denial of service on the affected machine. No patch is currently available for this medium-severity vulnerability.
Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems.
Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token “Orgkey” as authentication parameter. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can disable the Netskope client by using a specially-crafted. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Netskope client service running with NT\SYSTEM privileges accepts network connections from localhost to start various services and execute commands. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's portal thus leads to compromise admin's system. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts network connections from localhost. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts network connections from localhost. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Privilege escalation and arbitrary code execution affect Netskope Endpoint DLP (EPDLP) on Windows, where a privileged local user can send a crafted message to the EPDLP inter-process communication port to trigger a CWE-190 integer overflow, corrupting process memory. The vulnerability is gated behind two explicit non-default conditions - the EPDLP module must be active in the client configuration, and Windows Memory Integrity (HVCI/VBS) must be disabled on the host. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
The Endpoint DLP kernel driver (epdlpdrv.sys) in Netskope Client for Windows before release R141 exposes two overlapping flaws: an absent token-validation check on the internal kernel-to-userspace IPC channel, and an uninitialized reply buffer in the port message handler that returns residual kernel pool contents to callers. Any local unprivileged process can send unauthorized queries to the driver port without proving it is the legitimate hook DLL, then read uninitialized response buffers to extract DLP configuration data, feature flags, live session tokens, and kernel memory fragments from other users' concurrent operations. No public exploit code or CISA KEV listing exists at time of analysis.
Out-of-bounds heap read in Netskope Client's Endpoint DLP (EPDLP) service allows a local unprivileged user to crash the kernel driver handler by sending a specially crafted, unbounded message, temporarily suspending DLP policy enforcement. The flaw additionally leaks per-boot kernel memory layout information, providing an attacker a potential ASLR-bypass primitive. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog at time of analysis.
Tamper Protection bypass in Netskope Client for Windows allows a malicious local administrator to disable or subvert the endpoint security agent by directly manipulating the Windows service object and associated registry keys, which are protected by overly permissive Discretionary Access Control Lists. All Netskope Client versions below R138 on Windows are affected. No public exploit code exists and this vulnerability is not listed in CISA KEV, but the gap is operationally significant in environments where insider threat, post-compromise lateral movement, or separation of duties between IT admins and security tooling are concerns.
Anti-tampering bypass in Netskope Client for Windows (all versions prior to R138) allows a local administrator to send crafted IOCTL requests directly to the NSClient kernel driver, completely neutralizing the product's self-protection mechanisms. The flaw arises from CWE-782 - an IOCTL interface exposed by the driver without sufficient access controls - meaning a privileged insider can issue arbitrary control operations the driver was not designed to accept from untrusted callers. No public exploit has been identified at time of analysis, and exploitation is constrained to actors who already hold administrative privileges on the endpoint, limiting the realistic threat to insider scenarios or post-compromise lateral movement by an attacker who has already achieved admin-level access.
Netskope's Endpoint DLP Module for Windows is vulnerable to an integer overflow in its DLL Injector that can be triggered by a high-privileged local user to crash the system. When the Endpoint DLP module is enabled, successful exploitation results in a Blue Screen of Death and denial of service on the affected machine. No patch is currently available for this medium-severity vulnerability.
Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems.
Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token “Orgkey” as authentication parameter. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can disable the Netskope client by using a specially-crafted. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Netskope client service running with NT\SYSTEM privileges accepts network connections from localhost to start various services and execute commands. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's portal thus leads to compromise admin's system. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts network connections from localhost. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts network connections from localhost. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.