Security readout for executives and security teams
Plain-English summary
This issue affects Netskope Client on Windows before R138. A malicious insider who already has local administrator privileges may be able to weaken or bypass client tamper protections. The main business risk is loss of endpoint policy enforcement on compromised or misused administrator-controlled Windows systems.
Executive priority
Treat as a moderate-priority endpoint control issue. It is not described as remotely exploitable, but it can undermine Netskope protections where administrator access is misused or compromised.
Technical view
The vulnerability is an insufficient access control issue involving weak DACLs on the Netskope Client service object and related registry keys. The CVSS 4.0 vector is local, low complexity, high privileges, no user interaction, with high integrity and availability impact to the vulnerable system.
Likely exposure
Exposure is limited to Windows systems running Netskope Client versions below R138, especially where users, helpdesk staff, or attackers can obtain local administrator rights.
Exploitation context
The provided sources describe a malicious insider with administrator privileges. They do not report active exploitation, public exploit availability, or remote exploitation. CISA KEV status is false in the bundle.
Researcher notes
Evidence is narrow but consistent: CWE-276, Windows-only, high-privilege local attack precondition, and affected versions below R138. The bundle does not name specific registry paths, exploit artifacts, or detailed vendor fix mechanics.
Mitigation direction
- Upgrade affected Windows clients to R138 or later where available.
- Review Netskope advisory NSKPSA-2025-008 for vendor remediation details.
- Reduce and monitor local administrator access on Windows endpoints.
- Monitor for unauthorized changes to Netskope Client tamper protection state.
- Use endpoint management controls to enforce client version compliance.
Validation and detection
- Inventory Windows endpoints running Netskope Client.
- Identify any Netskope Client versions below R138.
- Confirm R138 or later deployment through endpoint management telemetry.
- Review local administrator group membership on affected endpoints.
- Check security logs for unexpected client service or registry permission changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-276: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-15642 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N——NetskopeVulnerability scoring details
Base CVSS 4.0 score
6.8MediumVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.netskope.com/resources/netskope-resources/netskope-security-advisory-nskpsa-2025-008CVE reference, Netskope
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Default Permissions
Incorrect Default Permissions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.