Vulnerability · Published Aug 14, 2025 · Assigned by Netskope
CVE-2025-0309Netskope Client Local Elevation of Privileges
Medium 6.0
In plain English
A medium-severity improper certificate validation in Netskope Client from Netskope. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system. The insufficient validation allows Netskope Client to connect to any other server with Public Signed CA TLS certificates and send specially crafted responses to elevate privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Netskope | Netskope Client | 0 – before 129.0.0 |
Weakness: CWE-295 · Vector: CVSS:4.0/AV:P/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:H/SI:H/SA:H