External risk intelligence

NCP Client Untrusted Search Path Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-26155

The vulnerability affects NCP Secure Enterprise Client and Secure Entry Client, which are endpoint software/VPN clients installed on individual user devices. These are client-side applications that do not function as internet-facing services, gateways, or public-facing infrastructure, making their specific local execution path unlikely to be exposed to or reachable from the public internet.

Ncp E Ncp Secure Entry Client

13.1913.18

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in NCP client software, specifically concerning how the application handles search paths. This could allow for unauthorized code execution, impacting the confidentiality, integrity, and availability of affected systems. Understanding the potential reach of this issue is key.

Untrusted search path allows malicious code execution.
Affects critical VPN client software.
Confirm relevance and exposure of this vulnerability.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by tricking a user into running a malicious program, leading to the execution of arbitrary code with elevated privileges. This is possible because the client software does not properly validate the origin or integrity of files it loads.

No privileges required to start.
User interaction to run malicious file.
High confidentiality, integrity, and availability impact.

Live Threat

Current exploitation, exposure, and threat context

An untrusted search path vulnerability in NCP Secure Enterprise Client and NCP Secure Entry Windows Client could allow an attacker to execute arbitrary code. This could occur when the client is launched and is configured to load components from a location that an attacker can influence. This may lead to the compromise of the affected client system.

Client application integrity and execution.
Loading malicious files via search path.
Arbitrary code execution on client.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability, affecting NCP Secure Enterprise Client and NCP Secure Entry Windows Client, is likely to be managed by endpoint or client-side application teams, with potential involvement from network or security teams for broader impact assessment. The first practical step is to identify all instances of the affected software, confirm their reachability and criticality, and then coordinate with the accountable owner for remediation.

Endpoint or client application teams own this issue.
Verify software deployment and user exposure.
Plan remediation based on verified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the NCP Secure Enterprise Client?

It is a VPN client software used on Windows devices to establish secure connections to corporate networks. It acts as an endpoint tool that manages encrypted communication tunnels, allowing users to access private resources remotely. Because it runs directly on local machines, it is categorized as client-side software rather than a server or gateway.

How does an Untrusted Search Path vulnerability work in CVE-2025-26155?

This vulnerability, classified as CWE-426, occurs when the software looks for necessary files or programs in insecure locations. Instead of only checking trusted system folders, the application might inadvertently check folders that an attacker can modify. If a malicious file is placed in one of these locations, the software may mistakenly load and execute that file as if it were a legitimate part of the program.

Do I need to be logged in for an attacker to trigger CVE-2025-26155?

This vulnerability is not triggered by simply having the software installed or connected to a network. It typically requires an attacker to successfully trick a user into performing a specific action, such as launching a malicious file or interacting with a compromised local environment. The flaw does not allow remote code execution through the network alone without this user-based interaction.

Is my NCP client at high risk if it is not exposed to the internet?

According to Halo Surface Signal, this vulnerability affects endpoint software installed on individual user devices, which generally do not function as internet-facing services. While the software is used for network connectivity, the specific flaw involves local file execution. Therefore, it is considered unlikely to be reachable or exploitable directly from the public internet.

What is the first step to address this NCP client vulnerability?

Your priority should be to create an accurate inventory of all devices in your organization running the affected versions of the NCP Secure Enterprise Client or NCP Secure Entry Windows Client. Once you have identified where the software is deployed, coordinate with your endpoint management or security teams to track and implement the necessary updates or configuration changes provided by the vendor.

References

www.ncp-e.com/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.