Live › vulnerability › CVE-2026-12254
Go to dashboardThe Netskope Client agent (NSClient) can leave a captive portal open when a device switches to a network that already has internet access. An attacker running a rogue access point can use that gap to direct traffic to malicious sites or exfiltrate data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Endpoints running the Netskope Client (NSClient) before R142 that connect to Wi-Fi networks with captive portals, particularly in environments where users roam between networks. Systems not running the Netskope Client are not described as affected by this issue.
No product ranges from the sources yet.
R142 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting to an access point with Captive Portal switches to a Network which already has internet connectivity, the Captive Portal does not close. This allows the possibility of abuse via the Captive Portal using a rogue access point to either access malicious sites or exfiltrate data.The issue impacts all versions prior to R142
This page as .md · .json · in your agent: get_signal("CVE-2026-12254")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.