Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-15710

Netskope Client Endpoint DLP Kernel Driver Information Leakage

CVSS 4.0 6.8 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-15710

Published

An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message validation, allowing local unprivileged processes to send unauthorized queries. Additionally, a reply buffer used by the port message handler was not properly initialized before returning data, leaking residual kernel pool memory from prior allocations. A local unprivileged attacker could exploit this vulnerability to enumerate DLP configuration and feature flags, extract live session tokens, and read kernel memory fragments from other users' operations.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-15710

Published

Endpoint DLP

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Netskope",
                    "product": "Endpoint DLP",
                    "platforms": [
                        "Windows"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "R141",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON