Medium severity · published Nov 28, 2025
CVE-2025-11156
Improper Service Loading Vulnerability in Netskope Endpoint DLP Driver
5.9
CVSS
0.1%
EPSS
No
On KEV
Description
Netskope was notified about a potential gap in its agent (NS Client) on Windows systems. If this gap is successfully exploited, a local, authenticated user with Administrator privileges can improperly load the driver as a generic kernel service. This triggers the flaw, causing a system crash (Blue-Screen-of-Death) and resulting in a Denial of Service (DoS) for the affected machine.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NC
Netskope Client · Netskope
before R132 · source: vendor
Affected product
NC
Netskope Client
Netskope
More from Netskope Client
8.8
CVE-2023-4996
Local privilege escalation
7.8
CVE-2023-2270
Local privilege escalation
7.0
CVE-2024-7402
Netskope Client Configuration Tampering with Local MITM
7.0
CVE-2022-4149
Local privilege escalation using log file
6.8
CVE-2025-15642
Netskope Client Service Insufficient Access Controls