Netskope Endpoint DLP up to R140 epdlpdrv.sys information disclosure

Summaryinfo

A vulnerability was found in Netskope Endpoint DLP up to R140. It has been declared as problematic. Affected by this issue is some unknown functionality of the file epdlpdrv.sys. Executing a manipulation can lead to information disclosure. This vulnerability is handled as CVE-2026-15710. It is possible to launch the attack on the local host. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Netskope Endpoint DLP up to R140. This vulnerability affects some unknown processing of the file epdlpdrv.sys. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message validation, allowing local unprivileged processes to send unauthorized queries. Additionally, a reply buffer used by the port message handler was not properly initialized before returning data, leaking residual kernel pool memory from prior allocations. A local unprivileged attacker could exploit this vulnerability to enumerate DLP configuration and feature flags, extract live session tokens, and read kernel memory fragments from other users' operations.

The advisory is shared for download at netskope.com. This vulnerability was named CVE-2026-15710 since 07/14/2026. The exploitation appears to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version R141 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Data Loss Prevention Software

Vendor

• Netskope

Name

• Endpoint DLP

Version

• R140

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion