CVE-2026-12254: CWE-613 Insufficient session expiration in Netskope Inc. Netskope Client

Netskope Client versions before R142 have a session management flaw (CWE-613) where, upon connecting to an access point with a captive portal and then switching to another network with internet connectivity, the captive portal session does not close as expected. This insufficient session expiration can be exploited by an attacker controlling a rogue access point to abuse the captive portal, potentially accessing malicious sites or exfiltrating data. The CVSS 4.0 base score is 6.4 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, but high scope and impact on confidentiality, integrity, and availability.

The vulnerability allows an attacker to abuse the captive portal session by using a rogue access point after the client switches networks, which may lead to exposure to malicious sites or data exfiltration. There is no indication of active exploitation in the wild. The impact affects confidentiality, integrity, and availability due to the session not expiring properly.

No official patch or remediation details are provided in the vendor advisory. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when switching networks involving captive portals and consider manual session termination or network isolation as temporary mitigations.