CVE-2025-15641

Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privileges can potentially tamper with the customer IOCTL by sending crafted IOCTL requests to the driver. A successful exploit can result in the bypassing of all anti-tampering protections for the NSClient.Affected Product(s) and Version(s) * Product Name: Netskope Client * Affected Platform: Windows * Affected Version: All version below R138

CVSS

No CVSS.

References

Link	Resource
https://www.netskope.com/resources/netskope-resources/netskope-security-advisory-nskpsa-2025-007

Configurations

No configuration.

History

30 Sep 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Netskope fue notificado sobre una posible brecha en su Netskope Cliente para sistemas Windows donde un atacante interno malicioso con privilegios administrativos puede potencialmente manipular el IOCTL del cliente enviando solicitudes IOCTL manipuladas al controlador. Un exploit exitoso puede resultar en la elusión de todas las protecciones antimanipulación para el NSCliente. Producto(s) y Versión(es) Afectado(s) * Nombre del Producto: Netskope Cliente * Plataforma Afectada: Windows * Versión Afectada: Todas las versiones anteriores a R138

Information

Published : 2026-06-17 13:19

Updated : 2026-10-07 08:10

NVD link : CVE-2025-15641

Mitre link : CVE-2025-15641

CVE.ORG link : CVE-2025-15641

JSON object : View

Products Affected

No product.

CWE

CWE-782

Exposed IOCTL with Insufficient Access Control

{"id": "CVE-2025-15641", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15641", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-17T14:57:15.545870Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "psirt@netskope.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "psirt@netskope.com", "affectedData": [{"vendor": "Netskope", "product": "Netskope Client", "versions": [{"status": "affected", "version": "0", "lessThan": "138", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "affected"}]}], "published": "2026-06-17T13:19:13.070", "references": [{"url": "https://www.netskope.com/resources/netskope-resources/netskope-security-advisory-nskpsa-2025-007", "source": "psirt@netskope.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@netskope.com", "description": [{"lang": "en", "value": "CWE-782"}]}], "descriptions": [{"lang": "en", "value": "Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privileges can potentially tamper with the customer IOCTL by sending crafted IOCTL requests to the driver. A successful exploit can result in the bypassing of all anti-tampering protections for the NSClient.Affected Product(s) and Version(s)\n * Product Name: Netskope Client\n * Affected Platform: Windows\n * Affected Version: All version below R138"}, {"lang": "es", "value": "Netskope fue notificado sobre una posible brecha en su Netskope Cliente para sistemas Windows donde un atacante interno malicioso con privilegios administrativos puede potencialmente manipular el IOCTL del cliente enviando solicitudes IOCTL manipuladas al controlador. Un exploit exitoso puede resultar en la elusi\u00f3n de todas las protecciones antimanipulaci\u00f3n para el NSCliente.\n\nProducto(s) y Versi\u00f3n(es) Afectado(s)\n* Nombre del Producto: Netskope Cliente\n* Plataforma Afectada: Windows\n* Versi\u00f3n Afectada: Todas las versiones anteriores a R138"}], "lastModified": "2026-10-07T08:10:00.200", "sourceIdentifier": "psirt@netskope.com"}