CVE-2026-12254Netskope Client Captive Portal WebView Persistence allowing SWG bypass issue
Updated under an hour ago ()
Does this affect you?
It affects Netskope Inc. Netskope Client. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting to an access point with Captive Portal switches to a Network which already has internet connectivity, the Captive Portal does not close. This allows the possibility of abuse via the Captive Portal using a rogue access point to either access malicious sites or exfiltrate data.The issue impacts all versions prior to R142
- CVSS
- 6.4 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
- Weakness (CWE)
- CWE-613
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Netskope
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 20, 2026
- First seen by InfoSec Signals
- Oct 19, 2026
Affected products
Netskope Inc. Netskope Client netskope:client (from the name) | before 142 | CNA record |
References
- https://www.netskope.com/resources/netskope-resources/netskope-security-advisory-nskpsa-2026-004
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.