Medium severity · published Nov 28, 2025
CVE-2025-11156
Improper Service Loading Vulnerability in Netskope Endpoint DLP Driver
5.9
CVSS
0.1%
EPSS
No
On KEV
Description
Netskope was notified about a potential gap in its agent (NS Client) on Windows systems. If this gap is successfully exploited, a local, authenticated user with Administrator privileges can improperly load the driver as a generic kernel service. This triggers the flaw, causing a system crash (Blue-Screen-of-Death) and resulting in a Denial of Service (DoS) for the affected machine.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NC
Netskope Client · Netskope
before R132 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11156
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11156
www.netskope.com
https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2025-005
More from Netskope Client
8.8
CVE-2023-4996
Local privilege escalation
7.8
CVE-2023-2270
Local privilege escalation
7.0
CVE-2024-7402
Netskope Client Configuration Tampering with Local MITM
7.0
CVE-2022-4149
Local privilege escalation using log file
6.8
CVE-2025-15642
Netskope Client Service Insufficient Access Controls
