Netskope’s NSClient has a flaw that prevents the captive portal WebView from closing once a network with internet connectivity is available. As a result, the client stays connected to the original network, allowing malicious or rogue access points to route traffic to unchecked destinations or exfiltrate data, effectively bypassing the security web gateway.

All Netskope Client releases prior to R142 are vulnerable, including builds R135, R138, and R141. Users on these versions could be exploited if they connect to an access point presenting a captive portal.

The CVSS score of 6.4 indicates moderate severity, but the EPSS score is not available, so the current exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread active exploitation yet. Exploitation requires a rogue or captive portal setup and a user to connect, making the attack vector less likely for remote attacks but still feasible in targeted scenarios, and it mainly threatens confidentiality and network policy compliance.