A weakness in the discretionary access control lists (DACLs) on the Netskope Client service object and related registry keys allows a malicious insider who already has administrative privileges to bypass the NSClient tamper protections. By doing so, an attacker could modify, replace, or otherwise tamper with the client binary or its configuration, potentially compromising the integrity and reliability of the client and the data it handles. The flaw does not directly provide remote code execution, but it enables unauthorized changes that could lead to further compromise.

The vulnerability applies to the Netskope Client for Windows, affecting all released versions lower than R138. It applies to any installation on Windows platforms where the service object and associated registry keys have the weak permission settings described.

The CVSS score of 6.8 reflects a moderate severity. Because the EPSS score is less than 1 percent and the issue is not listed in CISA KEV, the likelihood of exploitation is considered low. However, the attack requires a local attacker with administrative rights, making it a concern for environments where insider threats are possible. Exploitation would involve modifying the client or its registry settings to bypass tamper protection, which could undermine the trust model of the monitoring solution.