CVE-2026-2809

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2809", "assignerOrgId": "bf992f6a-e49d-4e94-9479-c4cff32c62bc", "state": "PUBLISHED", "assignerShortName": "Netskope", "dateReserved": "2026-02-19T15:53:20.256Z", "datePublished": "2026-03-17T20:20:18.698Z", "dateUpdated": "2026-03-18T19:59:38.332Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "bf992f6a-e49d-4e94-9479-c4cff32c62bc", "shortName": "Netskope", "dateUpdated": "2026-03-17T20:26:05.545Z"}, "title": "Endpoint DLP Driver DLL", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-190", "description": "CWE-190 Integer overflow or wraparound", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-92", "descriptions": [{"lang": "en", "value": "CAPEC-92 Forced Integer Overflow"}]}], "affected": [{"vendor": "Netskope", "product": "Endpoint DLP Module for Netskope Client", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "0", "lessThan": "132.0.20, 135", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can potentially allow a privileged user to trigger an integer overflow within the DLL Injector, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation would require the Endpoint DLP module to be enabled in the client configuration. A successful exploit can potentially result in a denial-of-service for the local machine.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can potentially allow a privileged user to trigger an integer overflow within the DLL Injector, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation would require the Endpoint DLP module to be enabled in the client configuration. A successful exploit can potentially result in a denial-of-service for the local machine.&nbsp;<br>"}]}], "references": [{"url": "https://support.netskope.com/s/article/NSKPSA-2026-001-Endpoint-DLP-Driver-DLL-Injector-Integer-Overflow", "tags": ["vendor-advisory", "permissions-required"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.7, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}], "configurations": [{"lang": "en", "value": "The Endpoint DLP module must be enabled in the client configuration", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The Endpoint DLP module must be enabled in the client configuration"}]}], "workarounds": [{"lang": "en", "value": "There are no direct workarounds. Some AV and EDR solutions may be able to detect behaviors associated with exploiting this vulnerability.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "There are no direct workarounds. Some AV and EDR solutions may be able to detect behaviors associated with exploiting this vulnerability."}]}], "credits": [{"lang": "en", "value": "Tom Brice", "type": "reporter"}], "source": {"advisory": "NSKPSA-2026-001", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-18T19:59:29.984901Z", "id": "CVE-2026-2809", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T19:59:38.332Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2809", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-18T19:59:29.984901Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T19:59:35.102Z"}}], "cna": {"title": "Endpoint DLP Driver DLL", "source": {"advisory": "NSKPSA-2026-001", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Tom Brice"}], "impacts": [{"capecId": "CAPEC-92", "descriptions": [{"lang": "en", "value": "CAPEC-92 Forced Integer Overflow"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.7, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Netskope", "product": "Endpoint DLP Module for Netskope Client", "versions": [{"status": "affected", "version": "0", "lessThan": "132.0.20, 135", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.netskope.com/s/article/NSKPSA-2026-001-Endpoint-DLP-Driver-DLL-Injector-Integer-Overflow", "tags": ["vendor-advisory", "permissions-required"]}], "workarounds": [{"lang": "en", "value": "There are no direct workarounds. Some AV and EDR solutions may be able to detect behaviors associated with exploiting this vulnerability.", "supportingMedia": [{"type": "text/html", "value": "There are no direct workarounds. Some AV and EDR solutions may be able to detect behaviors associated with exploiting this vulnerability.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can potentially allow a privileged user to trigger an integer overflow within the DLL Injector, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation would require the Endpoint DLP module to be enabled in the client configuration. A successful exploit can potentially result in a denial-of-service for the local machine.", "supportingMedia": [{"type": "text/html", "value": "Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can potentially allow a privileged user to trigger an integer overflow within the DLL Injector, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation would require the Endpoint DLP module to be enabled in the client configuration. A successful exploit can potentially result in a denial-of-service for the local machine.&nbsp;<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer overflow or wraparound"}]}], "configurations": [{"lang": "en", "value": "The Endpoint DLP module must be enabled in the client configuration", "supportingMedia": [{"type": "text/html", "value": "The Endpoint DLP module must be enabled in the client configuration", "base64": false}]}], "providerMetadata": {"orgId": "bf992f6a-e49d-4e94-9479-c4cff32c62bc", "shortName": "Netskope", "dateUpdated": "2026-03-17T20:26:05.545Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2809", "state": "PUBLISHED", "dateUpdated": "2026-03-18T19:59:38.332Z", "dateReserved": "2026-02-19T15:53:20.256Z", "assignerOrgId": "bf992f6a-e49d-4e94-9479-c4cff32c62bc", "datePublished": "2026-03-17T20:20:18.698Z", "assignerShortName": "Netskope"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Endpoint DLP Module for Netskope Client", "vendor": "Netskope", "versions": [{"lessThan": "132.0.20, 135", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "psirt@netskope.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can potentially allow a privileged user to trigger an integer overflow within the DLL Injector, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation would require the Endpoint DLP module to be enabled in the client configuration. A successful exploit can potentially result in a denial-of-service for the local machine."}, {"lang": "es", "value": "Se notific\u00f3 a Netskope sobre una posible brecha en su M\u00f3dulo DLP de Endpoint para el Cliente Netskope en sistemas Windows. La explotaci\u00f3n exitosa de la brecha puede potencialmente permitir a un usuario privilegiado desencadenar un desbordamiento de entero dentro del Inyector de DLL, lo que lleva a una Pantalla Azul de la Muerte (BSOD). La explotaci\u00f3n exitosa requerir\u00eda que el m\u00f3dulo DLP de Endpoint est\u00e9 habilitado en la configuraci\u00f3n del cliente. Un exploit exitoso puede potencialmente resultar en una denegaci\u00f3n de servicio para la m\u00e1quina local."}], "id": "CVE-2026-2809", "lastModified": "2026-06-17T10:31:49.110", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@netskope.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2809", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-18T19:59:29.984901Z", "version": "2.0.3"}}]}, "published": "2026-03-17T21:16:19.640", "references": [{"source": "psirt@netskope.com", "url": "https://support.netskope.com/s/article/NSKPSA-2026-001-Endpoint-DLP-Driver-DLL-Injector-Integer-Overflow"}], "sourceIdentifier": "psirt@netskope.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "psirt@netskope.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,132.0.20)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Endpoint DLP Module for Netskope Client", "source": "cna", "vendor": "Netskope"}, "product": "endpoint_dlp_module_for_netskope_client", "vendor": "netskope"}], "analysis": {"en": {"generated_at": "2026-03-17T21:20:53.835845+00:00", "value": {"mitigation_remediation": ["Deploy antivirus and EDR solutions that can detect exploitation behaviors associated with the integer overflow in the DLL injector.", "Monitor the system for unexpected BSOD events and unauthorized activity.", "Verify if Netskope has released an update or patch for the Endpoint DLP Module and apply it immediately when available.", "As a temporary measure, disable the Endpoint DLP module in the client configuration until a patch is applied."], "summary": {"action": "Monitor", "impact": "Denial of Service (Local BSOD)"}, "threat_synthesis": {"affected_systems": "Affected systems are Windows installations running Netskope Endpoint DLP Module for the Netskope Client with the DLP functionality enabled. Specific affected product versions are not listed in the available data.", "description_and_impact": "The vulnerability is an integer overflow in the DLL injector of Netskope's Endpoint DLP Module for Netskope Client, which can be triggered by a privileged user. Exploitation results in a Blue\u2011Screen\u2011of\u2011Death (BSOD), causing a denial\u2011of\u2011service on the local machine. The weakness is classified as CWE\u2011190 (Integer Overflow or Wraparound).", "risk_and_exploitability": "CVSS base score is 6.7, indicating moderate risk. EPSS data is unavailable, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires the Endpoint DLP module to be enabled and a privileged user to invoke the DLL injector. No public exploit evidence is documented, so actual risk depends largely on local privilege availability and the presence or absence of AV/EDR detection."}}}}, "created": "2026-03-18T10:42:49.565182+00:00", "updated": "2026-03-24T10:54:38.656184+00:00", "vendors": ["netskope", "netskope$PRODUCT$endpoint_dlp_module_for_netskope_client"]}