CVE-2026-16174

CVE-2026-16174 is an integer overflow (CWE-190) in the Netskope Endpoint DLP (EPDLP) component of the Netskope client on Windows, which corrupts memory when a crafted message is sent to the EPDLP process port. Exploitation requires three conditions: the EPDLP module must be enabled in the Netskope client configuration, Windows Memory Integrity (HVCI) must be disabled on the host, and the sender must be a privileged local user. A successful exploit could yield a denial of service, arbitrary code execution, or local privilege escalation on the affected machine. Only Windows endpoints running the Netskope client with the Endpoint DLP module enabled are affected. As of this analysis there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and Netskope (the assigned CNA) has not reported in-the-wild exploitation.

What to do: Check your Netskope client configurations for deployments with the Endpoint DLP (EPDLP) module enabled and identify Windows hosts where Memory Integrity (HVCI) is disabled; enabling Memory Integrity is an effective mitigation. Upgrade the Netskope client to the fixed release per Netskope's advisory (exact fixed version not included in this data), and note that exploitation requires a privileged local user, so limiting local admin rights also reduces risk.