CVE-2025-15641 Overview
CVE-2025-15641 affects the Netskope Client for Windows. A malicious insider with administrative privileges can send crafted I/O control (IOCTL) requests to the Netskope driver and tamper with custom IOCTL handling. A successful exploit bypasses all anti-tampering protections for the NSClient agent, allowing the attacker to disable or interfere with Netskope endpoint protections.
The issue is tracked under CWE-782: Exposed IOCTL with Insufficient Access Control and is documented in the Netskope Security Advisory NSKPSA-2025-007.
Critical Impact
An administrative local user can bypass Netskope Client anti-tampering controls, disabling endpoint protection on affected Windows hosts.
Affected Products
- Netskope Client for Windows — all versions below R138
- Windows endpoints running the affected NSClient
- Netskope kernel driver exposing the vulnerable IOCTL interface
Discovery Timeline
- 2026-06-17 - CVE-2025-15641 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-15641
Vulnerability Analysis
The Netskope Client for Windows includes a kernel-mode driver that exposes IOCTL handlers used by user-mode components. The driver does not adequately restrict or validate specific custom IOCTL requests against the calling context. An attacker holding administrative privileges on the host can craft IOCTL calls directly to the driver and reach code paths that should be reserved for trusted, signed Netskope components.
Reaching those paths defeats the anti-tampering layer that normally prevents administrators from stopping, unloading, or modifying the NSClient. With anti-tampering bypassed, the Netskope agent can be neutralized, exposing endpoints to data exfiltration, policy bypass, and downstream attacks that the Netskope Client would otherwise contain.
Root Cause
The root cause is improper exposure of an IOCTL interface to untrusted spheres of control [CWE-782]. The driver accepts custom IOCTLs without enforcing sufficient caller validation, so an administrative user can drive privileged driver functionality that should only be reachable from validated Netskope user-mode processes.
Attack Vector
Exploitation is local and requires high privileges on the Windows host. No user interaction is needed. The attacker opens a handle to the Netskope driver device object and issues DeviceIoControl calls with crafted control codes and payloads. The driver processes the request and effectively disables anti-tampering enforcement, allowing the attacker to terminate Netskope services, unload components, or modify protection state.
No verified public proof-of-concept code is available. See the Netskope Security Advisory NSKPSA-2025-007 for vendor details.
Detection Methods for CVE-2025-15641
Indicators of Compromise
- Unexpected handle opens to the Netskope client driver device object from non-Netskope processes.
- Netskope Client services (stAgentSvc, epdrSvc, related NSClient services) stopping, crashing, or being unloaded on hosts running versions below R138.
- Gaps in Netskope Client telemetry or policy enforcement events from previously healthy endpoints.
- Administrative tools or custom binaries issuing DeviceIoControl calls to Netskope driver objects.
Detection Strategies
- Inventory all Windows endpoints and flag any Netskope Client installation below version R138.
- Hunt for processes other than signed Netskope binaries opening handles to the Netskope driver, using EDR file and device access telemetry.
- Alert on local administrator sessions that stop Netskope services or modify Netskope registry keys and installation directories.
- Correlate sudden loss of Netskope cloud telemetry with local administrative activity on the same host.
Monitoring Recommendations
- Forward NSClient health and tamper events to your SIEM and alert on agent stop, restart, or driver unload events.
- Monitor Windows Security and Sysmon events for service control actions targeting Netskope services from interactive admin sessions.
- Track endpoints reporting Netskope Client versions and continuously verify they remain at R138 or later.
How to Mitigate CVE-2025-15641
Immediate Actions Required
- Upgrade the Netskope Client for Windows to release R138 or later on all managed endpoints.
- Audit which accounts hold local administrative rights on Windows hosts and remove privileges that are not strictly required.
- Enable and monitor Netskope tamper protection alerts and ensure they are routed to the security operations team.
- Validate Netskope Client health after upgrade by confirming version, service status, and policy sync from the Netskope tenant console.
Patch Information
Netskope has released a fixed Netskope Client build at version R138. All releases prior to R138 are affected. Apply the upgrade following the guidance in the Netskope Security Advisory NSKPSA-2025-007.
Workarounds
- Restrict local administrator membership on Windows endpoints to reduce the population of users who can reach the vulnerable IOCTL.
- Use application control (for example, Windows Defender Application Control or AppLocker) to block unauthorized binaries from executing with administrative privileges.
- Monitor for and alert on any unsigned or unexpected process opening handles to the Netskope driver device object until patching is complete.
# Verify installed Netskope Client version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Netskope\Provisioning\stAgent" |
Select-Object -Property InstallVersion, InstallDir
# Confirm the version is R138 or later before considering the host remediated
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
