Netskope Client for Windows exposes an IOCTL interface that lacks sufficient access controls. An attacker with local administrative privileges can send specially crafted IOCTL requests to the driver, allowing them to tamper with the client application. This tampering bypasses all anti‑tampering protections built into the NSClient, effectively allowing the attacker to modify or manipulate the client’s operation, potentially compromising data integrity or availability.

The vulnerability affects the Netskope Client for Windows. All installations running a version earlier than R138 are impacted. Versions R138 and above, as well as R135 (135.1.19.2670+) and R132 (132.0.27.2671+), include the official patch to mitigate the risk.

The CVSS score of 6.8 indicates a moderate severity vulnerability, and the EPSS score of less than 1% denotes a very low likelihood of exploitation in the wild. The use of this vulnerability requires local administrative rights, so it is primarily an insider threat scenario. It is not listed in the CISA KEV catalog, further reflecting the limited exploitation probability.