CVE-2025-15641

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15641", "assignerOrgId": "bf992f6a-e49d-4e94-9479-c4cff32c62bc", "state": "PUBLISHED", "assignerShortName": "Netskope", "dateReserved": "2026-04-22T15:49:43.557Z", "datePublished": "2026-06-17T01:31:51.228Z", "dateUpdated": "2026-06-17T14:57:22.093Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "bf992f6a-e49d-4e94-9479-c4cff32c62bc", "shortName": "Netskope", "dateUpdated": "2026-06-17T01:50:01.108Z"}, "title": "Netskope Client Exposed IOCTL with Insufficient Access Controls", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-782", "description": "CWE-782 Exposed IOCTL with insufficient access control", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-176", "descriptions": [{"lang": "en", "value": "CAPEC-176 Configuration/Environment Manipulation"}]}], "affected": [{"vendor": "Netskope", "product": "Netskope Client", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "0", "lessThan": "138", "versionType": "custom"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privileges can potentially tamper with the customer IOCTL by sending crafted IOCTL requests to the driver. A successful exploit can result in the bypassing of all anti-tampering protections for the NSClient.Affected Product(s) and Version(s)\n * Product Name: Netskope Client\n * Affected Platform: Windows\n * Affected Version: All version below R138", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privileges can potentially tamper with the customer IOCTL by sending crafted IOCTL requests to the driver. A successful exploit can result in the bypassing of all anti-tampering protections for the NSClient.<div>Affected Product(s) and Version(s)<br><ul><li>Product Name: Netskope Client</li><li>Affected Platform: Windows</li><li>Affected Version: All version below R138</li></ul></div>"}]}], "references": [{"url": "https://www.netskope.com/resources/netskope-resources/netskope-security-advisory-nskpsa-2025-007"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "workarounds": [{"lang": "en", "value": "No workaround available", "supportingMedia": [{"type": "text/html", "base64": false, "value": "No workaround available"}]}], "solutions": [{"lang": "en", "value": "Use any of the below version of Netskope Client:\n * R138 and above\n * R135 (135.1.19.2670 and above )\n * R132 (132.0.27.2671 and above )", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Use any of the below version of Netskope Client:<br><ul><li>R138 and above</li><li>R135 (135.1.19.2670 and above )</li><li>R132 (132.0.27.2671 and above )</li></ul>"}]}], "exploits": [{"lang": "en", "value": "Netskope is not aware of any active exploitation of the security issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Netskope is not aware of any active exploitation of the security issue."}]}], "credits": [{"lang": "en", "value": "Netskope credits Juan Pablo Barriga for reporting this flaw.", "type": "finder"}], "source": {"advisory": "NSKPSA-2025-007", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-17T14:57:15.545870Z", "id": "CVE-2025-15641", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-17T14:57:22.093Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15641", "assignerOrgId": "bf992f6a-e49d-4e94-9479-c4cff32c62bc", "state": "PUBLISHED", "assignerShortName": "Netskope", "dateReserved": "2026-04-22T15:49:43.557Z", "datePublished": "2026-06-17T01:31:51.228Z", "dateUpdated": "2026-06-17T14:57:22.093Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "bf992f6a-e49d-4e94-9479-c4cff32c62bc", "shortName": "Netskope", "dateUpdated": "2026-06-17T01:50:01.108Z"}, "title": "Netskope Client Exposed IOCTL with Insufficient Access Controls", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-782", "description": "CWE-782 Exposed IOCTL with insufficient access control", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-176", "descriptions": [{"lang": "en", "value": "CAPEC-176 Configuration/Environment Manipulation"}]}], "affected": [{"vendor": "Netskope", "product": "Netskope Client", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "0", "lessThan": "138", "versionType": "custom"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privileges can potentially tamper with the customer IOCTL by sending crafted IOCTL requests to the driver. A successful exploit can result in the bypassing of all anti-tampering protections for the NSClient.Affected Product(s) and Version(s)\n * Product Name: Netskope Client\n * Affected Platform: Windows\n * Affected Version: All version below R138", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privileges can potentially tamper with the customer IOCTL by sending crafted IOCTL requests to the driver. A successful exploit can result in the bypassing of all anti-tampering protections for the NSClient.<div>Affected Product(s) and Version(s)<br><ul><li>Product Name: Netskope Client</li><li>Affected Platform: Windows</li><li>Affected Version: All version below R138</li></ul></div>"}]}], "references": [{"url": "https://www.netskope.com/resources/netskope-resources/netskope-security-advisory-nskpsa-2025-007"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "workarounds": [{"lang": "en", "value": "No workaround available", "supportingMedia": [{"type": "text/html", "base64": false, "value": "No workaround available"}]}], "solutions": [{"lang": "en", "value": "Use any of the below version of Netskope Client:\n * R138 and above\n * R135 (135.1.19.2670 and above )\n * R132 (132.0.27.2671 and above )", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Use any of the below version of Netskope Client:<br><ul><li>R138 and above</li><li>R135 (135.1.19.2670 and above )</li><li>R132 (132.0.27.2671 and above )</li></ul>"}]}], "exploits": [{"lang": "en", "value": "Netskope is not aware of any active exploitation of the security issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Netskope is not aware of any active exploitation of the security issue."}]}], "credits": [{"lang": "en", "value": "Netskope credits Juan Pablo Barriga for reporting this flaw.", "type": "finder"}], "source": {"advisory": "NSKPSA-2025-007", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15641", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-17T14:57:15.545870Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-17T14:57:18.624Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "platforms": ["Windows"], "product": "Netskope Client", "vendor": "Netskope", "versions": [{"lessThan": "138", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "psirt@netskope.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privileges can potentially tamper with the customer IOCTL by sending crafted IOCTL requests to the driver. A successful exploit can result in the bypassing of all anti-tampering protections for the NSClient.Affected Product(s) and Version(s)\n * Product Name: Netskope Client\n * Affected Platform: Windows\n * Affected Version: All version below R138"}, {"lang": "es", "value": "Netskope fue notificado sobre una posible brecha en su Netskope Cliente para sistemas Windows donde un atacante interno malicioso con privilegios administrativos puede potencialmente manipular el IOCTL del cliente enviando solicitudes IOCTL manipuladas al controlador. Un exploit exitoso puede resultar en la elusi\u00f3n de todas las protecciones antimanipulaci\u00f3n para el NSCliente.\n\nProducto(s) y Versi\u00f3n(es) Afectado(s)\n* Nombre del Producto: Netskope Cliente\n* Plataforma Afectada: Windows\n* Versi\u00f3n Afectada: Todas las versiones anteriores a R138"}], "id": "CVE-2025-15641", "lastModified": "2026-10-07T08:10:00.200", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@netskope.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15641", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-17T14:57:15.545870Z", "version": "2.0.3"}}]}, "published": "2026-06-17T13:19:13.070", "references": [{"source": "psirt@netskope.com", "url": "https://www.netskope.com/resources/netskope-resources/netskope-security-advisory-nskpsa-2025-007"}], "sourceIdentifier": "psirt@netskope.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-782"}], "source": "psirt@netskope.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,138)"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "Netskope Client", "source": "cna", "vendor": "Netskope"}, "product": "netskope", "vendor": "netskope"}], "created": "2026-06-17T18:00:04.258272+00:00", "updated": "2026-06-26T07:45:16.338582+00:00", "vendors": ["netskope", "netskope$PRODUCT$netskope"]}