Weak Discretionary Access Control in Netskope Client for Windows Systems
CVE-2025-15642

6.8MEDIUM

Key Information:

Vendor

Netskope

Status
Netskope Client
Vendor
CVE Published:
17 June 2026

Badges

👾 Exploit Exists

What is CVE-2025-15642?

Netskope has been alerted to a significant vulnerability within the Netskope Client for Windows systems. This issue arises from insufficient Discretionary Access Control List (DACL) configurations on the service object and associated registry keys. A malicious insider with administrative privileges could exploit this weakness, enabling them to bypass the NSClient tamper protections. As a result, unauthorized actions may be performed within the system, compromising data integrity and user security. All versions prior to R138 are affected, highlighting the urgent need for users to assess their security measures and consider necessary updates.

Affected Version(s)

Netskope Client Windows 0

References

https://www.netskope.com/resources/netskope-resources/net...

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Netskope credits Juan Pablo Barriga for reporting this flaw.
.