Medium severity · published Nov 28, 2025
CVE-2025-11156
Improper Service Loading Vulnerability in Netskope Endpoint DLP Driver
5.9
CVSS
0.1%
EPSS
No
On KEV
Description
Netskope was notified about a potential gap in its agent (NS Client) on Windows systems. If this gap is successfully exploited, a local, authenticated user with Administrator privileges can improperly load the driver as a generic kernel service. This triggers the flaw, causing a system crash (Blue-Screen-of-Death) and resulting in a Denial of Service (DoS) for the affected machine.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NC
Netskope Client · Netskope
before R132 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11156
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11156
www.netskope.com
https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2025-005
More from Netskope Client
7.0
CVE-2024-7402
Netskope Client Configuration Tampering with Local MITM
6.8
CVE-2025-15642
Netskope Client Service Insufficient Access Controls
6.8
CVE-2025-15641
Netskope Client Exposed IOCTL with Insufficient Access Controls
6.0
CVE-2025-0309
Netskope Client Local Elevation of Privileges
5.7
CVE-2025-5942
Heap Overflow in Netskope Endpoint DLP Driver