Security Advisories and Disclosures

Netskope PSIRT

Advisories and Disclosures

Report a security vulnerability

Vulnerability Disclosure Policy

Netskope Product Security Incident Response Team (PSIRT)

Netskope PSIRT is the centralized process through which Netskope customers, security researchers, industry groups, government organizations, or vendors report potential Netskope security vulnerabilities.

The Netskope team manages the receipt, investigation and internal coordination of security vulnerability information related to all Netskope products, offerings and websites. This team then coordinates with each individual Netskope product and solution team to investigate, and if needed, identify the appropriate response plan. Maintaining communication between all involved parties, both internal and external, is a key component of Netskope’s vulnerability response process.

Advisories and Disclosures

We strongly believe in responsible and coordinated disclosures of vulnerabilities that may affect the services we provide. Public disclosure of vulnerabilities is an essential part of the vulnerability disclosure process and is one of the many paths that lead to making software better and enables learnings that makes the security community better.

Security Advisory ID	Severity Rating	Fix Version	Fix Description
NSKPSA-2025-003	Medium	R129 and above	Netskope Client is impacted by Heap Overflow vulnerability
NSKPSA-2025-002	Medium	R129 and above	Netskope Local Escalation of Privileges
NSKPSA-2025-001	Low	R129 and above	Netskope Client is impacted by Out-of-Bounds Read vulnerability
NSKPSA-2024-004	Medium	R123‬ and above	Netskope Client installer with symbolic link following‬ ‭ vulnerability leading to privilege escalation
NSKPSA-2024-003	Medium	Release 119 and above	Endpoint DLP double-fetch leading to heap-overflow
NSKPSA-2024-002	High	R123(123.0.16), 126(126.0.9), R129 or higher	Netskope Client configurations tampering with MITM
NSKPSA-2024-001	High	N/A	Netskope client enrollment bypass issue
NSKPSA-2023-003	Medium	Release 101	Netskope NSClient is impacted by local privilege escalation vulnerability to terminate the NSClient
NSKPSA-2023-002	High	Release 100	Local privilege escalation using log files in Netskope Client
NSKPSA-2023-001	High	Release 100	Local privilege escalation vulnerability in Netskope Client
NSKPSA-2022-001	High	Release 92	Sensitive information stored in NSClient logs
NSKPSA-2021-002	High	Release 89	Local privilege escalation vulnerability in Netskope Client on macOS
NSKPSA-2020-005	Critical	Release 81	Netskope Client Stack Buffer Overflow
NSKPSA-2020-004	Critical	Release 81	Netskope Client Stack Buffer Overflow
NSKPSA-2020-002	High	Release 79	Netskope Admin UI CSV Injection
NSKPSA-2020-001	High	Release 78	Fix for Privilege Escalation Vulnerability Discovered in Netskope Windows Client

Report a security vulnerability

We appreciate your partnership and value your decision to make us one of your trusted security partners. We believe a partnership is centered on working together, delivering transparency and commitment to making it better. If you have questions or concerns please contact your Technical Success Manager or write to Netskope Product Security Incident Response Team, [email protected].

Customers

Third party researchers

Customers

Customers and other entitled users should report any potential security vulnerabilities they may discover in Netskope products or offerings via normal Netskope Technical Support processes.

Go to Technical Support

Third party researchers

Third party researchers and other security entities can report potential security vulnerabilities in Netskope products, offerings, or websites.

Vulnerability Disclosure Policy

At Netskope, we take our responsibility to protect our users’ information and the services we provide to them very seriously.

Linked below is our Vulnerability Disclosure Policy. The Vulnerability Disclosure Policy describes what systems and types of research are covered under this policy, how to send us vulnerability reports, and how long we ask security researchers to wait before publicly disclosing vulnerabilities.

Vulnerability Disclosure Policy