Netskope Windows Client Vulnerability Enables Privilege Escalation via Rogue Server

A serious security vulnerability in Netskope’s Windows client has been disclosed that could allow attackers to escalate privileges from a low-privileged user to full system-level access, tracked as CVE-2025-0309. The flaw affects all versions of the Netskope Windows client prior to version R129 and has prompted Netskope to release urgent security updates, including version R129 released on 13 August 2025.

According to Amber Wolf, the vulnerability centres on the client’s enrollment process and can be exploited via a rogue server by manipulating the IPC communications between the low-privileged client UI process (stAgentUI) and the privileged service (stAgentSvc) that runs with SYSTEM privileges.

Attackers craft a specially formatted JWT containing a rogue server URL, send it through the IPC channel, and the rogue server then delivers malicious configurations and a fraudulent certificate authority to compromise the trust chain and install a backdoored software update. Netskope has issued advisories NSKPSA-2025-002 and guidance to update to R129, with detection methods including monitoring for suspicious certificates in the trusted root store and unusual Netskope MSI installations.