CVE-2025-0309 Netskope Client Local Elevation of Privileges
Local attackers can elevate privileges by exploiting insufficient server endpoint validation in the Netskope Client.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-0309?
CVE-2025-0309 is a medium-severity vulnerability in Netskope Client, published on 14 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system. The insufficient validation allows Netskope Client to connect to any other server with Public Signed CA TLS certificates and send specially crafted responses to elevate privileges.
Weakness: CWE-295
Which versions are affected by CVE-2025-0309?
How do I fix CVE-2025-0309?
No fix has been published for CVE-2025-0309 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-0309 being exploited?
There is no known exploitation of CVE-2025-0309 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-f728-v2h3-3vfv.