Netskope Client and Endpoint DLP
CVE-2025-11156: Improper Service Loading Vulnerability in Netskope Endpoint DLP Driver
Netskope was notified about a potential gap in its agent (NS Client) on Windows systems.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Netskope Client (Windows) 0 | R132 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Netskope was notified about a potential gap in its agent (NS Client) on Windows systems. If this gap is successfully exploited, a local, authenticated user with Administrator privileges can improperly load the driver as a generic kernel service. This triggers the flaw, causing a system crash (Blue-Screen-of-Death) and resulting in a Denial of Service (DoS) for the affected machine.
Am I affected?
Must be using Netskope Endpoint DLP
Workarounds
EDR solutions can be leveraged to block any process attempting to create a kernel service pointing to epdlpdrv.sys driver.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 10 Oct 2026.