CVE-2026-2810: Out-of-Bounds Read in Netskope Client
Platform
windows
Component
netskope-client
Fixed in
129.1.8,132.0.23,135.1.0,136.1
CVE-2026-2810 describes an out-of-bounds read vulnerability discovered in the Netskope Client Endpoint DLP Driver for Windows systems. Successful exploitation can lead to a Blue-Screen-of-Death (BSOD), resulting in a denial-of-service condition for the affected machine. This vulnerability impacts Netskope Client versions ranging from 0.0.0 through 136.1, and a fix is available in versions 129.1.8, 132.0.23, 135.1.0, and 136.1.
Impact and Attack Scenarios
The core impact of CVE-2026-2810 is a denial-of-service (DoS) condition. An attacker who can successfully exploit this vulnerability can trigger a BSOD, effectively crashing the local machine and disrupting its operations. The vulnerability requires the Endpoint DLP module to be enabled within the Netskope Client configuration, limiting the attack surface to systems where this feature is active. While the vulnerability doesn't directly lead to data exfiltration or remote code execution, the resulting DoS can be disruptive and potentially allow an attacker to mask other malicious activities. The blast radius is limited to the individual machine experiencing the BSOD; however, in environments with many Netskope clients, the cumulative impact could be significant.
Exploitation Context
CVE-2026-2810 was disclosed on April 29, 2026. The vulnerability's severity is pending evaluation. Currently, there are no publicly available proof-of-concept (POC) exploits. There are no indications of active campaigns targeting this specific vulnerability. Monitor security advisories and threat intelligence feeds for updates.
Threat Intelligence
Exploit Status
EPSS
0.02% (4% percentile)
Affected Software
Weakness Classification (CWE)
Timeline
- Published
- EPSS updated
Mitigation and Workarounds
The primary mitigation for CVE-2026-2810 is to upgrade the Netskope Client Endpoint DLP Driver to a version containing the fix (129.1.8, 132.0.23, 135.1.0, or 136.1). If immediate upgrading is not possible due to compatibility issues or testing requirements, consider temporarily disabling the Endpoint DLP module within the Netskope Client configuration. This will reduce the attack surface, but also disable the DLP functionality. There are no known WAF or proxy rules that can directly mitigate this driver-level vulnerability. Monitor system logs for BSOD events and correlate them with Netskope Client activity to identify potential exploitation attempts. Sigma/YARA rules for detecting BSOD triggers related to driver errors could be developed, but require further analysis of the BSOD dump files.
How to fix
Actualice el Netskope Client a la versión 129.1.8 o posterior, 132.0.23 o posterior, 135.1.0 o posterior, o 136.1 o posterior para mitigar la vulnerabilidad de lectura fuera de límites en el controlador Endpoint DLP. Consulte la documentación de Netskope o su sitio de soporte para obtener instrucciones de actualización específicas.
Frequently asked questions
What is CVE-2026-2810 — Out-of-Bounds Read in Netskope Client?
CVE-2026-2810 is a vulnerability in the Netskope Client Endpoint DLP Driver that allows an attacker to trigger a Blue-Screen-of-Death (BSOD), leading to a denial-of-service. It affects versions 0.0.0–129.1.8, 132.0.23, 135.1.0, and 136.1.
Am I affected by CVE-2026-2810 in Netskope Client?
You are affected if you are using Netskope Client with the Endpoint DLP module enabled and running a version between 0.0.0 and 136.1 (inclusive).
How do I fix CVE-2026-2810 in Netskope Client?
Upgrade to a fixed version of Netskope Client: 129.1.8, 132.0.23, 135.1.0, or 136.1. As a temporary workaround, disable the Endpoint DLP module.
Is CVE-2026-2810 being actively exploited?
Currently, there are no indications of active exploitation campaigns targeting CVE-2026-2810, but monitoring is recommended.
Where can I find the official Netskope advisory for CVE-2026-2810?
Refer to the Netskope security advisory published on April 29, 2026, for detailed information and updates.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...