CVE-2026-2809: Netskope Endpoint DLP DoS Vulnerability

CVE-2026-2809 Overview

CVE-2026-2809 is an integer overflow vulnerability [CWE-190] in the Netskope Endpoint Data Loss Prevention (DLP) Module for the Netskope Client on Windows systems. A privileged local user can trigger the overflow within the DLL Injector component, causing a kernel fault that results in a Blue-Screen-of-Death (BSOD). Successful exploitation requires the Endpoint DLP module to be enabled in the client configuration. The outcome is a denial-of-service condition on the affected local machine, with no impact to confidentiality or integrity.

Critical Impact
A privileged local user can crash a Windows endpoint running the Netskope Client with Endpoint DLP enabled, producing a system-wide denial of service.

Affected Products

Netskope Client for Windows with Endpoint DLP Module enabled
Netskope Endpoint DLP Driver — DLL Injector component
Refer to the Netskope Security Advisory NSKPSA-2026-001 for affected versions

Discovery Timeline

2026-03-17 - CVE-2026-2809 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-2809

Vulnerability Analysis

The vulnerability resides in the DLL Injector logic of the Netskope Endpoint DLP module on Windows. The DLL Injector is responsible for loading DLP enforcement libraries into monitored processes so the agent can inspect data flows. During this injection workflow, a calculation involving size or offset values is not bounded correctly, allowing an integer overflow.

When the overflow occurs, downstream memory operations in the kernel-adjacent code path operate on invalid sizes. This produces a fault that Windows handles by issuing a bug check, resulting in a Blue-Screen-of-Death. The attacker does not gain code execution or read protected data — the only observed impact is loss of availability for the local host.

Exploitation requires local access with high privileges. The Endpoint DLP module must also be enabled in the client configuration, which limits the attack surface to deployments that actively use Netskope DLP enforcement on endpoints.

Root Cause

The root cause is an integer overflow [CWE-190] in size or length arithmetic inside the DLL Injector. The component fails to validate that arithmetic on attacker-influenced inputs remains within representable bounds before passing the result to memory or buffer routines.

Attack Vector

The attack vector is local. A user already holding high privileges on the Windows endpoint interacts with the DLL Injector in a way that supplies values triggering the overflow. The crafted input forces the flawed calculation, the driver enters an invalid state, and the operating system halts with a BSOD. No network access, no user interaction from a second party, and no authentication beyond the existing privileged session are required.

No public proof-of-concept code is available. Refer to the Netskope Security Advisory NSKPSA-2026-001 for vendor-supplied technical details.

Detection Methods for CVE-2026-2809

Indicators of Compromise

Unexpected Windows bug check events (BugCheck entries in the System event log) on endpoints running the Netskope Client with Endpoint DLP enabled.
Memory dump files referencing the Netskope DLP driver or DLL Injector module in the faulting stack.
Repeated crashes of the Netskope Client service correlated with activity from a single privileged local account.

Detection Strategies

Correlate Windows Event ID 1001 (BugCheck) and Event ID 41 (Kernel-Power unexpected shutdown) with the loaded Netskope DLP driver path.
Hunt for privileged process executions that immediately precede a host crash on systems with the Endpoint DLP module enabled.
Compare crash frequency on DLP-enabled endpoints against a baseline to surface targeted denial-of-service attempts.

Monitoring Recommendations

Forward Windows kernel crash telemetry and Netskope Client service status events to a centralized SIEM or data lake for correlation.
Track minidump generation on endpoints and alert when the faulting module matches the Netskope DLP driver.
Monitor for administrative account activity on endpoints that precedes repeated reboots or service restarts.

How to Mitigate CVE-2026-2809

Immediate Actions Required

Apply the fixed Netskope Client version identified in Netskope Security Advisory NSKPSA-2026-001.
Inventory all Windows endpoints with the Endpoint DLP module enabled and prioritize them for patching.
Restrict and audit accounts that hold local administrator or equivalent high privileges on endpoints.

Patch Information

Netskope has published guidance and a fixed release in advisory NSKPSA-2026-001. Administrators should review the advisory for the exact fixed client build, validate the update in a test ring, and roll it out through standard endpoint management tooling. Confirm post-update that the Endpoint DLP module loads and enforces policy as expected.

Workarounds

Where patching is delayed, evaluate temporarily disabling the Endpoint DLP module in client configuration, accepting the loss of DLP enforcement on those hosts.
Tighten local privilege assignments so fewer accounts meet the high-privilege precondition required for exploitation.
Enable crash reporting and automatic recovery so impacted endpoints return to service quickly while patching proceeds.

bash

# Configuration example
# Identify Windows hosts running the Netskope Client and review recent bug checks
Get-Service -Name "stAgentSvc" -ErrorAction SilentlyContinue
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1001} -MaxEvents 50 |
  Where-Object { $_.Message -match 'Netskope|stAgent|DLP' }