Read the docs
TI-2025-00250 Aliases CVE-2025-0309GHSA-f728-v2h3-3vfv

Netskope Client Local Elevation of Privileges

Priority LOW 26CWE-295Published · Updated

Key facts

Attack vector
Physical
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Spoofing
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system. The insufficient validation allows Netskope Client to connect to any other server with Public Signed CA TLS certificates and send specially crafted responses to elevate privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00186 8th percentileScored 2026-11-07
Fix Fixed Netskope Client (Netskope): 129.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NetskopeNetskope Clientbefore 129.0.0129.0.0Patch availableCNA
  • Netskope Client VendorNetskope Affected before 129.0.0 Fixed in 129.0.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:netskope:netskope:*:*:*:*:*:*:*:*——Netskope
  • cpe:2.3:a:netskope:netskope:*:*:*:*:*:*:*:* Versions — — ·Netskope

Remediation

  • Fix · CNA Netskope Client (Netskope) Fixed in 129.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-0309
  2. 2026-10-03 Alias added: GHSA-f728-v2h3-3vfv

References

Advisory 2

  • TI-2020-15056 Netskope Client through 77 allows low-privileged users to elevate their privileges to NT AUTHORITY\SYSTEM. CVSS 3.1HIGH 8.8
  • TI-2026-13525 Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow CVSS 4.0HIGH 8.7
  • TI-2024-06860 Client Enrollment Process Bypass CVSS 4.0HIGH 8.5
  • TI-2023-04599 Local privilege escalation in Netskope Client CVSS 3.1HIGH 8.8
  • TI-2021-20302 Sensitive Information store in NSClient logs CVSS 3.1HIGH 8.4
  • TI-2023-02129 Local privilege escalation in Netskope Client CVSS 3.1HIGH 7.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences