Is CVE-2026-16172 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16172 being exploited in the wild.

How severe is CVE-2026-16172?

Informational severity, published 10 September 2026.

Is there a fix for CVE-2026-16172?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16172 attacked?

It is attacked with local access.

Am I affected by CVE-2026-16172?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16172: Netskope Client out-of-bounds heap read in Endpoint DLP

CVE-2026-16172 · Severity: info · Published 2026-09-10

Netskope Client is a security agent that enforces data loss prevention (DLP) policies on endpoints. A local attacker can send a specially crafted message that bypasses validation checks, potentially crashing the DLP service and temporarily disabling data protection controls. The vulnerability may also leak memory layout information that could be used in follow-up attacks.

Quick answers

Is CVE-2026-16172 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16172 being exploited in the wild.
How severe is CVE-2026-16172?: Informational severity, published 10 September 2026.
Which products and versions are affected?: Netskope Client <UNKNOWN>.
Is there a fix for CVE-2026-16172?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16172 attacked?: It is attacked with local access.
Am I affected by CVE-2026-16172?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is an out-of-bounds heap read in the Endpoint DLP (EPDLP) service of Netskope Client, stemming from insufficient bounds checking on specially crafted messages sent to the kernel driver handler. A local standard user (no elevated privileges required) can trigger the vulnerability by sending a malformed message. Successful exploitation can crash the EPDLP service, temporarily disrupting DLP policy enforcement, and may disclose per-boot memory layout information that could aid in subsequent exploitation attempts. No patch or fix availability is specified in the advisory.

Affected products

Netskope Client <UNKNOWN>

Timeline

2026-09-10: disclosed

References

https://support.netskope.com/s/article/Netskope-Security-Advisory-Netskope-Client-Endpoint-DLP-Security-Notice---NSKPSA-2026-008

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.