CVE-2026-15710 Netskope CVE debrief

Who should care

Defenders responsible for securing Netskope Client for Windows deployments should assess exposure and implement compensating controls to restrict access to sensitive information. System administrators and security teams should verify if the system is affected and apply the patch or upgrade to version R141 or later.

Why it matters

The information leakage vulnerability in Netskope Client for Windows Endpoint DLP component allows local unprivileged attackers to access sensitive information, requiring defenders to verify exposure and implement compensating controls.

• Local unprivileged attackers could enumerate DLP configuration and feature flags
• Local unprivileged attackers could extract live session tokens
• Local unprivileged attackers could read kernel memory fragments from other users' operations
• Verify exposure and implement compensating controls to restrict access to sensitive information

Technical summary

The Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141 has an information leakage vulnerability. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message validation, allowing local unprivileged processes to send unauthorized queries. A reply buffer used by the port message handler was not properly initialized before returning data, leaking residual kernel pool memory from prior allocations.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls, as the vulnerability allows unauthorized queries and information leakage.

Recommended defensive actions

• Verify if the system is affected by checking the version of Netskope Client for Windows
• Implement compensating controls to restrict access to sensitive information
• Monitor system logs for suspicious activity
• Apply the patch or upgrade to version R141 or later
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141, allowing local unprivileged processes to send unauthorized queries and leak residual kernel pool memory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.