{"id":"CVE-2026-12254","title":"Netskope Client Captive Portal WebView Persistence allowing SWG bypass issue","summary":"Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting to an access point with Captive Portal switches to a Network which already has internet connectivity, the Captive Por…","severity":"medium","cvss":6.4,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","cvssSource":"cna","cwe":["CWE-613"],"vendor":"Netskope Inc.","product":"Netskope Client","affected":["netskope_client < 142"],"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T15:37:11.423Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-12254","references":[{"url":"https://www.netskope.com/resources/netskope-resources/netskope-security-advisory-nskpsa-2026-004"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T16:32:30.076Z","slug":"CVE-2026-12254","body":"## Overview\n\nNetskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting to an access point with Captive Portal switches to a Network which already has internet connectivity, the Captive Portal does not close. This allows the possibility of abuse via the Captive Portal using a rogue access point to either access malicious sites or exfiltrate data.The issue impacts all versions prior to R142\n\n## Affected\n\n- `netskope_client < 142`\n\n## Remediation\n\nNetskope has fixed the gap and released the patch as listed below:\nR142 and above\nR141 (141.1.7.2827 and above)\nR138 (138.1.15.2826 and above)\nR135 (135.1.7.2827 and above)","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":35.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}