CVE-2022-4149: The Netskope client service (prior to R96) on Windows runs as NT AUTHORITY\SYSTEM which writes log files to a

Q: How do I fix CVE-2022-4149?

netskope: upgrade to 100. Exact commands for each OS are on this page.

Q: Is CVE-2022-4149 being exploited?

CVE-2022-4149 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2022-4149 affect?

CVE-2022-4149 affects netskope. Severity is high (CVSS 7.0). The Netskope client service (prior to R96) on Windows runs as NT AUTHORITY\SYSTEM which writes log files to a writable directory (C:\Users\Public\netSkope) for a standard user. The files are created and written with a SYSTEM account except

Routine

HIGH 7.0UPGRADE

CVE-2022-4149 is a high-severity flaw (CVSS 7.0) affecting netskope. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The Netskope client service (prior to R96) on Windows runs as NT AUTHORITY\SYSTEM which writes log files to a writable directory (C:\Users\Public\netSkope) for a standard user. The files are created and written with a SYSTEM account except one file (logplaceholder) which inherits permission giving all users full access control list. Netskope client restricts access to this file by allowing only read permissions as a standard user. Whenever the Ne

Why this priority

High severity

A fixed release or distro patch exists.

Risk facts

CVSS score	7.0 (High)
Attack vector	Local
Attack complexity	High
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.2% (top 95%)
CISA exploited list	No
Weakness	CWE-367
Published	2023-06-15
Last modified	2026-06-17

Publisher (CNA): Netskope · Vendor: netskope

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2023-06-15 07:15 UTCPublished CVE record published
2026-06-17 05:20 UTCUpdated Record last modified

netskope netskope UPGRADE

Affected: < 100

Fixed in: 100

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy netskope || rpm -q netskope || netskope --version

2. UPGRADE to 100 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade netskope

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade netskope

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2022-4149?

netskope: upgrade to 100. Exact commands for each OS are on this page.

Is CVE-2022-4149 being exploited?

CVE-2022-4149 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2022-4149 affect?

CVE-2022-4149 affects netskope. Severity is high (CVSS 7.0). The Netskope client service (prior to R96) on Windows runs as NT AUTHORITY\SYSTEM which writes log files to a writable directory (C:\Users\Public\netSkope) for a standard user. The files are created and written with a SYSTEM account except

How urgent is CVE-2022-4149?

Priority 26/100. High severity

Software pages

Windows vulnerabilities

Related CVEs

CVE-2024-7401 HIGH 7.5 MITIGATE Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a sta
CVE-2023-4996 MEDIUM 6.6 UPGRADE Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a ma
CVE-2023-2270 HIGH 7.0 UPGRADE The Netskope client service running with NT\SYSTEM privileges accepts network connections from localhost to st

References

← Back to latest CVEs