CVE-2026-15710

Executive Summary

CVE-2026-15710 is an information leakage vulnerability in the Endpoint DLP kernel driver (epdlpdrv.sys) of the Netskope Client for Windows prior to version R141. The flaw allows a local unprivileged process to send unauthorized queries through an internal communication channel to the daemon and to read uninitialized kernel pool memory, resulting in leakage of DLP configuration, feature flags, live session tokens, and residual memory fragments from other users' operations. Any Windows endpoint running an affected Netskope Client version is in scope; impact is confidentiality-focused with no integrity or availability impact, but leaked session tokens and configuration data can materially aid follow-on attacks.

Technical Analysis

The vulnerability resides in two distinct but related weaknesses within the Netskope Endpoint DLP kernel driver epdlpdrv.sys:

1. Missing token-based message validation on the user-space-to-kernel-to-daemon channel. The user-space hook DLL communicates with the daemon by passing messages through the kernel driver. This internal channel lacked proper token-based message validation, meaning a local unprivileged process could send messages that the driver accepted and forwarded to the daemon as though they originated from a legitimate, trusted component. This is the authorization defect that enables unauthorized queries.

2. Uninitialized reply buffer (CWE-908). The port message handler used a reply buffer that was not properly initialized before returning data. When the handler returned a response shorter than the allocated buffer, the uninitialized tail of that buffer — containing residual kernel pool memory from prior allocations — was exposed to the calling process.

The combination means a local attacker with no privileges can (a) issue queries that the driver treats as authorized, and (b) read kernel memory fragments that were not intended to be disclosed. The disclosure includes DLP configuration and feature flags, live session tokens, and memory fragments from other users' operations.

Note on precision: the NVD description does not disclose specific function names, IOCTL codes, message formats, or endpoint names. The analysis above is limited to the described mechanisms — missing token validation on an internal message channel and an uninitialized reply buffer in the port message handler. No further implementation-level detail can be stated without fabrication.

Attack surface: local, on-host. The driver is loaded as part of the Netskope Client endpoint agent. No network reachability is required for the initial trigger; the attacker must simply be able to execute code on the same Windows host with unprivileged credentials.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available. The attack chain below is inferred strictly from the vulnerability class described in the NVD description.

1. Reconnaissance / target identification. The attacker obtains unprivileged code execution on a Windows endpoint where Netskope Client (prior to R141) is installed. The attacker confirms the endpoint agent and its DLP kernel driver are present and active. No remote scanning is required — the target is the local host itself.

2. Triggering the specific flaw class. The attacker interacts with the driver's internal communication channel — the same channel the user-space hook DLL uses to pass messages to the daemon — from an unprivileged process. Because token-based message validation is absent on that channel, the driver does not distinguish the attacker's messages from legitimate ones and forwards the unauthorized queries to the daemon. This is an authorization-bypass condition.

3. Payload / execution method (vulnerability-class level). Through the accepted queries, the attacker enumerates DLP configuration and feature flags and extracts live session tokens. Separately, by invoking the port message handler and observing the reply, the attacker reads data returned from an uninitialized buffer, capturing residual kernel pool memory from prior allocations — including fragments from other users' operations.

4. Post-exploitation impact. Leaked session tokens can be leveraged to impersonate or hijack legitimate sessions or to authenticate to downstream services that trust those tokens. Enumerated DLP configuration and feature flags reveal defensive posture and may allow the attacker to tune exfiltration activity to avoid detection. Kernel memory fragments may disclose further sensitive data from other operations on the host, enabling additional targeting or credential theft. No elevation to kernel code execution, integrity modification, or denial of service is described for this vulnerability.

Impact Assessment

• Confidentiality: High. The flaw exposes DLP configuration, feature flags, live session tokens, and kernel memory fragments belonging to other users' operations.
• Integrity: None (per described scope). The vulnerability is an information leakage issue; no modification of data or code is described.
• Availability: None (per described scope). No DoS or resource exhaustion is described.
• Attack Vector: Local (AV:L). Requires unprivileged code execution on the affected host.
• Attack Complexity: Low (AC:L). No special conditions beyond local access are described; the message channel and port handler are present whenever the client runs.
• Privileges Required: Low (PR:L). Explicitly "local unprivileged processes."
• User Interaction: None (UI:N).

These subscores produce the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The NVD has not assigned a numeric score (N/A), and FIRST.org has not yet scored EPSS; no value should be assumed.

Business-impact considerations:

• Blast radius: Every managed Windows endpoint running an affected Netskope Client build is potentially in scope. In large enterprises this can be tens of thousands of hosts.
• Session token exposure is the most operationally significant outcome: tokens can bridge the gap between a low-privileged foothold on one host and access to systems or services that trust those tokens.
• DLP configuration disclosure directly undermines the defensive control by revealing detection rules, feature flags, and policy posture, enabling targeted evasion.
• Multi-user hosts (VDI, RDS, shared workstations) amplify risk because leaked kernel pool fragments may originate from other users' operations on the same machine.
• Regulatory impact: Leakage of user-associated memory fragments and configuration data may implicate privacy and data-protection obligations depending on the data resident in kernel pool memory.
• CISA KEV: not listed. No known exploitation in the wild at the time of writing.

Detection Guidance

Sigma Rule

title: Netskope Endpoint DLP Driver Unauthorized Local Query Attempt (CVE-2026-15710)
id: 8f3c2a91-7d4e-4b1a-9c11-2e5f6a7b8c90
status: experimental
description: Detects local unprivileged processes attempting to open or send messages to the Netskope Endpoint DLP kernel driver (epdlpdrv.sys) communication channel, consistent with CVE-2026-15710 abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-15710
author: valtersit.com
date: 2026-01-01
tags:
  - attack.privilege-escalation
  - attack.t1068
  - cve.2026.15710
logsource:
  product: windows
  category: process_access
detection:
  selection_target:
    TargetImage|endswith: '\epdlpdrv.sys'
  selection_calltrace:
    CallTrace|contains: 'epdlpdrv.sys'
  selection_unsigned:
    Signed|contains: 'false'
  condition: selection_target or (selection_calltrace and selection_unsigned)
falsepositives:
  - Legitimate Netskope Client components loading the driver
  - Endpoint management tooling querying driver status
level: high

YARA Rule

rule CVE_2026_15710_Netskope_epdlpdrv_InfoLeak
{
    meta:
        author = "valtersit.com"
        date = "2026-01-01"
        description = "Detects Netskope Endpoint DLP driver epdlpdrv.sys and related components associated with CVE-2026-15710 information leakage"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-15710"
        cve = "CVE-2026-15710"
        severity = "high"

    strings:
        $drv     = "epdlpdrv.sys" ascii wide nocase
        $nlp     = "Netskope" ascii wide nocase
        $epdlp   = "Endpoint DLP" ascii wide nocase
        $hookdll = "hook" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D and filesize < 20MB and
        ($drv and $nlp) or ($epdlp and $nlp and $hookdll)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-15710 Netskope Endpoint DLP potential session token/endpoint telemetry exfiltration"; flow:established,to_server; content:"Netskope"; http_header; content:"Authorization"; http_header; nocase; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-user; reference:cve,2026-15710; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-15710; sid:202615710; rev:1;)

Note: CVE-2026-15710 is a local information-leakage vulnerability; network telemetry is only relevant when leaked session tokens or DLP configuration are subsequently transmitted off-host. The rule above is a best-effort network-side heuristic and should be tuned to the environment's telemetry endpoints.

Elastic Detection

process where event.type == "start" and process.name != null and
  process.parent.name in ("services.exe","lsass.exe") == false and
  process.args != null and
  (
    process.args : "*epdlpdrv*" or
    process.executable : "*Netskope*" or
    process.command_line : "*epdlpdrv*"
  )

Supplement with a process_access EQL rule:

process where event.category == "process" and event.action == "process_access" and
  process.Ext.device_description : "*epdlpdrv*"

Splunk SPL Query

index=main (source="WinEventLog:Microsoft-Windows-Sysmon/Operational" OR source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
(EventCode=10 OR EventCode=1 OR EventCode=11)
| search (TargetImage="*epdlpdrv.sys" OR Image="*epdlpdrv.sys" OR CommandLine="*epdlpdrv*" OR Image="*Netskope*Client*")
| eval risk=case(
    EventCode=10 AND TargetImage="*epdlpdrv.sys", "HIGH - driver handle access",
    EventCode=1 AND CommandLine="*epdlpdrv*", "MEDIUM - driver invocation",
    true(), "LOW")
| stats count min(_time) as firstTime max(_time) as lastTime values(Image) as images values(CommandLine) as cmds by ComputerName, User, risk
| where count > 0
| convert ctime(firstTime) ctime(lastTime)
| sort - count

Wazuh OSSEC Rule

<group name="windows,netskope,cve_2026_15710,">
  <rule id="202615710" level="12">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.targetImage">epdlpdrv\.sys</field>
    <description>CVE-2026-15710: Possible unprivileged process access to Netskope Endpoint DLP driver (epdlpdrv.sys)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,information_leak,</group>
  </rule>

  <rule id="202615711" level="10">
    <if_group>sysmon_event1</if_group>
    <field name="win.eventdata.commandLine">epdlpdrv</field>
    <description>CVE-2026-15710: Process command line references Netskope Endpoint DLP driver</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue exists "prior to version R141," indicating the vendor fix ships in R141, but no advisory or patch artifact has been confirmed by tracked sources.

1. Immediate mitigations

   • Inventory all Windows endpoints running Netskope Client and identify those below R141.
   • Restrict local interactive and scripted code execution to reduce the population of hosts from which an unprivileged attacker could reach the driver channel.
   • Enforce least privilege; monitor for and eliminate unnecessary local accounts and unmanaged elevation paths.
   • Where the agent is not strictly required, consider temporarily removing or disabling the DLP component on the highest-risk hosts after change-control review.
   • Monitor kernel pool memory disclosure indicators (driver handle opens, anomalous query patterns to the agent) while a fix is pending.

2. Patch / upgrade steps

   • Upgrade Netskope Client for Windows to R141 or later as soon as the vendor-supplied build is available in the organization's distribution channel.
   • Verify the installed build by checking the client version reported by the endpoint agent and the on-disk driver version.
   • Reboot endpoints after upgrade to ensure the new kernel driver is loaded; kernel driver replacement does not take effect until reboot.
   • Re-validate DLP policy enforcement and feature flags after upgrade to confirm expected behavior.

3. Long-term hardening

   • Adopt a formal endpoint-agent patch SLAs that treats kernel-driver components as high-priority assets.
   • Enforce token-based authentication and message validation for any internal user-space-to-kernel-to-daemon communication channels in first-party and third-party agents before deployment.
   • Require zero-initialization and length-bounded copies for all reply and pool buffers in kernel drivers as a code-review gate.
   • Deploy kernel-mode code integrity and driver blocklisting to prevent untrusted drivers from loading alongside trusted security agents.
   • Maintain telemetry on agent-internal channel activity and integrate it into the SOC detection pipeline.
   • Include third-party security-agent drivers in threat modeling and purple-team exercises; they run with high privilege and are attractive local-attack targets.

References

1. NVD — CVE-2026-15710: https://nvd.nist.gov/vuln/detail/CVE-2026-15710
2. CWE-908 — Use of Uninitialized Resource: https://cwe.mitre.org/data/definitions/908.html
3. MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
4. Netskope Client documentation and release notes (R141 and later): https://www.netskope.com/
5. FIRST.org EPSS (currently unscored for this CVE): https://www.first.org/epss/

Threat actor / exploitation status: No public exploit code, PoC, or Nuclei template has been identified. The vulnerability is not listed in CISA KEV. No named threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-15710 at the time of this report.