What’s Vulnerable › Vulnerabilities
CVE-2026-15710: Netskope Client Endpoint DLP Kernel Driver Information Leakage
- Severity: medium (CVSS 6.8 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-11 · updated 2026-09-18
- Weakness: CWE-908
Description
An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message validation, allowing local unprivileged processes to send unauthorized queries. Additionally, a reply buffer used by the port message handler was not properly initialized before returning data, leaking residual kernel pool memory from prior allocations. A local unprivileged attacker could exploit this vulnerability to enumerate DLP configuration and feature flags, extract live session tokens, and read kernel memory fragments from other users' operations.
Affected products
- Netskope Endpoint DLP: before R141 — fixed in R141
How to fix
Upgrade to a fixed version: Netskope Endpoint DLP R141. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-15710 or the next vulnerability affects your stack