CVE-2026-12254: Netskope Client Captive Portal WebView Persistence allowing SWG bypass issue

Q: Which deployments are affected?

The issue affects Netskope Client (NSClient) versions before R142. It applies when a device connects to an access point presenting a captive portal and then switches to a network that already has internet connectivity.

Q: What does an attacker need to exploit this issue?

An attacker would need to operate or control a rogue access point with a captive portal and induce a Netskope Client device to connect to it. The user must then transition to another internet-connected network while the captive portal remains open.

Q: What is the potential impact of successful exploitation?

The persistent captive portal WebView could be abused to access malicious sites or exfiltrate data, bypassing Secure Web Gateway controls. The CVSS vector indicates impacts are assessed on subsequent systems rather than directly compromising the vulnerable client’s confidentiality, integrity, or availability.

Q: What should organizations do?

Upgrade affected Netskope Client installations to R142 or later. Until upgraded, treat connections to untrusted or rogue wireless access points and captive portals as a relevant exposure condition.

Published Oct 19, 2026

Updated

Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting to an access point with Captive Portal switches to a Network which already has internet connectivity, the Captive Portal does not close. This allows the possibility of abuse via the Captive Portal using a rogue access point to either access malicious sites or exfiltrate data.The issue impacts all versions prior to R142

Affected Software

1 affected component

Netskope Netskope Client<R142

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Netskope Client (NSClient) to a version that resolves this vulnerability.
Fixed in 135.1.7.2827
Upgrade
Upgrade Netskope Client (NSClient) to a version that resolves this vulnerability.
Fixed in 138.1.15.2826
Upgrade
Upgrade Netskope Client (NSClient) to a version that resolves this vulnerability.
Fixed in 141.1.7.2827
Upgrade
Upgrade Netskope Client (NSClient) to a version that resolves this vulnerability.
Fixed in R142

Event History

Oct 19, 2026

CVE Published

via MITRE·03:37 PM

Data Sourced

via MITRE·03:37 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

The issue affects Netskope Client (NSClient) versions before R142. It applies when a device connects to an access point presenting a captive portal and then switches to a network that already has internet connectivity.

What does an attacker need to exploit this issue?

An attacker would need to operate or control a rogue access point with a captive portal and induce a Netskope Client device to connect to it. The user must then transition to another internet-connected network while the captive portal remains open.

What is the potential impact of successful exploitation?

The persistent captive portal WebView could be abused to access malicious sites or exfiltrate data, bypassing Secure Web Gateway controls. The CVSS vector indicates impacts are assessed on subsequent systems rather than directly compromising the vulnerable client’s confidentiality, integrity, or availability.

What should organizations do?

Upgrade affected Netskope Client installations to R142 or later. Until upgraded, treat connections to untrusted or rogue wireless access points and captive portals as a relevant exposure condition.

CVE-2026-12254: Netskope Client Captive Portal WebView Persistence allowing SWG bypass issue

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the potential impact of successful exploitation?

What should organizations do?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the potential impact of successful exploitation?

What should organizations do?