NCP E maintains a focused portfolio of secure remote-access and client software, including its Secure Enterprise Client and related endpoint connectivity products that serve enterprise VPN and network-access use cases. The vendor's vulnerability disclosures, while modest in volume, reflect the security-sensitive nature of authentication and network-access software, where client-side and protocol-handling weaknesses surface periodically across its product line. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Ncp E over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-26155CRITICAL NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path vulnerability. | Nov 26, 2025 | 9.8 | 29 | NO | NO |
CVE-2017-17023HIGH The Sophos UTM VPN endpoint interacts with client software provided by NPC Engineering (www.ncp-e.com). The affected client software, "Sophos IPSec Client" 11.04 is a rebranded ver | Apr 9, 2019 | 8.1 | 26 | NO | NO |
CVE-2023-28872HIGH Support Assistant in NCP Secure Enterprise Client before 13.10 allows attackers to execute DLL files with SYSTEM privileges by creating a symbolic link from a %LOCALAPPDATA%\Temp\N | Dec 25, 2023 | 8.8 | 23 | NO | NO |
CVE-2023-28868HIGH Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete arbitrary files on the operating system by creating a symbolic link. | Dec 9, 2023 | 8.1 | 22 | NO | NO |
CVE-2020-11474HIGH NCP Secure Enterprise Client before 10.15 r47589 allows a symbolic link attack on enumusb.reg via Support Assistant. | Jul 28, 2020 | 7.8 | 20 | NO | NO |
CVE-2010-5203MEDIUM Multiple untrusted search path vulnerabilities in NCP Secure Enterprise Client before 9.21 Build 68, Secure Entry Client before 9.23 Build 18, and Secure Client - Juniper Edition b | Sep 6, 2012 | 6.9 | 20 | NO | NO |
CVE-2023-28869MEDIUM Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers read the contents of arbitrary files on the operating system by creating a symbolic link. | Dec 9, 2023 | 6.5 | 19 | NO | NO |
CVE-2023-28870MEDIUM Insecure File Permissions in Support Assistant in NCP Secure Enterprise Client before 12.22 allow attackers to write to configuration files from low-privileged user accounts. | Dec 9, 2023 | 6.5 | 18 | NO | NO |
CVE-2023-28871MEDIUM Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to read registry information of the operating system by creating a symbolic link. | Dec 9, 2023 | 4.3 | 15 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Ncp E.
Media articles that mention a CVE ID that affects a product developed by Ncp E — matched by CVE ID, not by vendor name.