The vulnerability CVE-2025-15642 in Netskope Client for Windows arises from weak Discretionary Access Control Lists (DACLs) on the service object and associated registry keys. This misconfiguration permits a malicious insider with administrative privileges to bypass the NSClient Tamper Protections, potentially allowing unauthorized modification or disabling of the client’s protections. The affected versions include all releases prior to R138. The CVSS 4.0 score is 6.8, indicating a medium severity with local attack vector, low attack complexity, and requiring high privileges.

A malicious insider with administrative privileges on a Windows system running an affected Netskope Client version can bypass NSClient Tamper Protections due to weak default permissions. This could lead to unauthorized changes to the client’s service or registry settings, potentially undermining the security controls provided by the Netskope Client.

No official patch or remediation guidance has been provided yet by Netskope. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should limit administrative access to trusted personnel and monitor for unauthorized changes to the Netskope Client service and registry keys.