NSKPSA-2026-006 - Netskope Client Endpoint DLP Security Notice

Security Advisory ID: NSKPSA-2026-006

Version: 1.0

Status: Published

First Published: September 10, 2026

Description
Netskope was notified of an information leakage vulnerability in the Endpoint DLP component (epdlpdrv.sys) of the Netskope Client. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message validation, allowing local unprivileged processes to send unauthorized queries. Additionally, a reply buffer used by the port message handler was not properly initialized before returning data (CWE-908), causing residual kernel pool memory from prior allocations to be leaked to the caller. Successful exploitation could allow a local unprivileged attacker to enumerate DLP configuration and feature flags, extract live session tokens, and read kernel memory fragments from other users’ operations.

Affected Product(s) and Version(s)
Product Name: Netskope Endpoint DLP
Affected Platform: Windows
Affected Version: All versions below R141

CVE-ID(s)
CVE-2026-15710

Remediation

Netskope has released a security patch for the issue. Please see below

• Patch versions: R141 and above

• Patch backported versions:

  • R135.0.2.7298 and above
  • R138.0.0.7305 and above

Netskope upgrade instructions are listed here and Netskope download Instructions are listed on Support portal – Download Netskope Client and Scripts – Netskope Support

Workaround
There are no workarounds available at this time.

General Security Best Practices
Netskope recommends using security hardening options available in the product and configuring them to harden the security of a Netskope tenant: https://docs.netskope.com/en/secure-tenant-configuration-and-hardening/

Special Notes and Acknowledgement
Netskope would like to thank the following KBTG Cybersecurity Research Engineers for responsibly reporting this vulnerability:

• Nuttakorn Tungpoonsup
• Jirawat Siengphao
• Khanatip Vanjongkham
• Waris Damkham

Exploitation and Public Disclosures
Netskope is not aware of any public disclosure or active exploitation of this issue.

Revision History

Legal Disclaimer:
To the maximum extent permitted by applicable law, information provided in this notice is provided “as is” without warranty of any kind. Your use of the information in this notice or materials linked herein are at your own risk. This notice and all aspects of Netskope’s Product Security Incident Response Policy are subject to change without notice. Response is not guaranteed for any specific issue or class of issues.  Your entitlements regarding warranties, support and maintenance, including vulnerabilities in any Netskope software or service, are governed solely by the applicable master agreement between Netskope and you. The statements in this notice do not modify, enlarge or otherwise amend any of your rights under the applicable master agreement, or create any additional warranties or commitments.

About Netskope
Netskope (NASDAQ: NTSK), a leader in modern security and networking for the cloud and AI era, addresses the needs of both security and networking teams by providing optimized access and real-time, context-based security for the AI ecosystem inclusive of agents, applications, tools, LLMs, people, devices, and data. Thousands of customers, including more than 30 of the Fortune 100, trust the Netskope One platform, its Zero Trust Engine, and its powerful NewEdge network to reduce risk and gain full visibility and control over cloud, AI, SaaS, web, and private applications – providing security and accelerating performance without trade-offs. Learn more at www.netskope.com, Netskope.ai, on LinkedIn, and Instagram.