CVE-2025-15642: Netskope Client Auth Bypass Vulnerability

CVE-2025-15642 Overview

CVE-2025-15642 is a tamper protection bypass vulnerability affecting the Netskope Client for Windows. The flaw stems from weak Discretionary Access Control Lists (DACLs) applied to the NSClient service object and associated registry keys. A local attacker with administrative privileges can leverage these permissive ACLs to disable or modify the Netskope Client, defeating the agent's tamper protection controls. The vulnerability is classified under [CWE-276]: Incorrect Default Permissions. Netskope has addressed the issue in Client release R138.

Critical Impact
A malicious insider with local administrator privileges on a Windows endpoint can bypass NSClient Tamper Protections, allowing modification or shutdown of the security agent and undermining endpoint enforcement of Netskope policies.

Affected Products

Netskope Client for Windows — all versions below R138
Windows endpoints running Netskope Client
Netskope-managed deployments relying on NSClient Tamper Protection

Discovery Timeline

2026-06-17 - CVE-2025-15642 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-15642

Vulnerability Analysis

The Netskope Client on Windows enforces tamper protection to prevent unauthorized modification of the agent. CVE-2025-15642 exists because the NSClient Windows service object and several related registry keys are assigned overly permissive DACLs. These ACLs grant write or control access to principals that should not be able to alter security-critical components. An administrator-level user can reconfigure the service, change its startup parameters, or modify registry values that control tamper protection enforcement. Once these controls are weakened, the attacker can stop the service, disable telemetry, or load alternative configurations. The result is a complete bypass of NSClient Tamper Protections on the affected endpoint.

Root Cause

The root cause is incorrect default permissions on Windows objects ([CWE-276]). The service object and registry keys associated with NSClient were created with DACLs that allow modification by accounts beyond the minimum required SYSTEM context. This violates least-privilege principles for tamper-resistant security agents.

Attack Vector

Exploitation requires local access and high privileges (administrator) on the Windows host. No user interaction is required. The attacker queries the NSClient service security descriptor with tools such as sc sdshow nsclient or modifies registry keys under HKLM\SYSTEM\CurrentControlSet\Services\ to alter the service configuration. Because the existing DACL permits these operations, tamper protection is neutralized without exploitation of a memory corruption flaw. Refer to the Netskope Security Advisory NSKPSA-2025-008 for vendor technical details.

Detection Methods for CVE-2025-15642

Indicators of Compromise

Unexpected stops, restarts, or configuration changes to the NSClient Windows service.
Modification of registry values under the NSClient service key, including ImagePath, Start, or tamper-related subkeys.
Use of sc.exe, reg.exe, or PowerShell Set-Service cmdlets targeting the Netskope Client service by non-standard administrative accounts.
Gaps in Netskope Client telemetry or policy enforcement on endpoints reporting as active in the Netskope tenant.

Detection Strategies

Monitor Windows Security event IDs 4670 (permissions changed) and 7040 (service start type changed) for the NSClient service.
Alert on Sysmon Event ID 13 registry modifications targeting Netskope service registry paths.
Correlate process creation events (Event ID 4688 / Sysmon 1) where sc.exe or reg.exe interact with nsclient or Netskope paths.

Monitoring Recommendations

Baseline expected administrative activity against the Netskope Client and flag deviations.
Forward endpoint telemetry to a centralized SIEM or data lake for cross-host correlation of tamper attempts.
Track endpoints where the Netskope Client version remains below R138 as elevated-risk assets until patched.

How to Mitigate CVE-2025-15642

Immediate Actions Required

Upgrade the Netskope Client for Windows to release R138 or later across all managed endpoints.
Inventory hosts still running pre-R138 versions and prioritize them for remediation.
Audit local administrator group membership on Windows endpoints to reduce the population capable of exploiting this flaw.

Patch Information

Netskope has remediated CVE-2025-15642 in Netskope Client R138. The fix tightens DACLs on the NSClient service object and related registry keys so that only SYSTEM-level principals can modify tamper-protection-critical objects. Distribute the updated client through standard Netskope deployment workflows. See Netskope Security Advisory NSKPSA-2025-008 for vendor guidance.

Workarounds

Restrict local administrator rights on Windows endpoints to limit the pool of accounts able to abuse the weak DACLs.
Enable application control or privileged access management to gate use of sc.exe, reg.exe, and PowerShell service cmdlets.
Continuously monitor NSClient service health and alert when the service is stopped or reconfigured outside change windows.

bash

# Verify Netskope Client version on a Windows endpoint
reg query "HKLM\SOFTWARE\Netskope\Provisioning" /v version

# Inspect the current DACL on the NSClient service
sc.exe sdshow nsclient