Zscaler vulnerabilities
58 vulnerabilities
Known vulnerabilities in Zscaler products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 11 products.
Products
11- Client Connector50 vulnerabilities
- Zscaler Internet Access Admin Portal3 vulnerabilities
- ZIA Admin UI2 vulnerabilities
- Zscaler Client Connector2 vulnerabilities
- Authentication Server1 vulnerabilities
- Secure Internet And Saas Access1 vulnerabilities
- ZIA1 vulnerabilities
- ZIA Admin Portal1 vulnerabilities
- Zscaler Proxy1 vulnerabilities
- Zscaler Mcp Server1 vulnerabilities
- ZIA File Type Control0 vulnerabilities
CVE-2021-26738zscalerclient_connector
EPSS score0.23%
Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local adversary may be able to execute code with root privileges.CVE-2021-26735zscalerclient_connectorEPSS score0.13%
The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversary may be able to execute code with SYSTEM privileges.CVE-2021-26737zscalerclient_connectorEPSS score0.11%
The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients. A local adversary without sufficient privileges may be able to shutdown the Zscaler tunnel by exploiting a race condition.CVE-2021-26734zscalerclient_connectorEPSS score0.14%
Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation. A local adversary may be able to delete folders in an elevated context.CVE-2021-26736zscalerclient_connectorEPSS score0.22%
Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged path. A local adversary may be able to execute code with SYSTEM privileges.CVE-2025-54982zscalerauthentication serverEPSS score0.40%
An improper verification of cryptographic signature in Zscaler's SAML authentication mechanism on the server-side allowed an authentication abuse.CVE-2025-54983zscalerzscaler client connectorEPSS score0.13%
A health check port on Zscaler Client Connector on Windows, versions 4.6 < 4.6.0.216 and 4.7 < 4.7.0.47, which under specific circumstances was not released after use, allowed traffic to potentially bypass ZCC forwarding controls.CVE-2020-11635zscalerclient_connectorEPSS score0.44%
The Zscaler Client Connector prior to 3.1.0 did not sufficiently validate RPC clients, which allows a local adversary to execute code with system privileges or perform limited actions for which they did not have privileges.CVE-2020-11634zscalerclient_connectorEPSS score0.46%
The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL. A local adversary may be able to execute arbitrary code in the SYSTEM context.CVE-2020-11633zscalerclient_connectorEPSS score1.89%
The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer overflow when connecting to misconfigured TLS servers. An adversary would potentially have been able to execute arbitrary code with system privileges.CVE-2020-11632zscalerclient_connectorEPSS score0.32%
The Zscaler Client Connector prior to 2.1.2.150 did not quote the search path for services, which allows a local adversary to execute code with system privileges.CVE-2024-31127zscalerclient_connectorEPSS score0.10%
An improper verification of a loaded library in Zscaler Client Connector on Mac < 4.2.0.241 may allow a local attacker to elevate their privileges.CVE-2024-3661ciscoanyconnect_vpn_client+63EPSS score4.06%
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.CVE-2024-23459zscalerclient_connectorEPSS score0.47%
An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allows a system file to be overwritten.This issue affects Zscaler Client Connector on Mac : before 3.7.CVE-2024-23482zscalerclient_connectorEPSS score0.27%
The ZScaler service is susceptible to a local privilege escalation vulnerability found in the ZScalerService process. Fixed Version: Mac ZApp 4.2.0.241 and later.CVE-2024-23463zscalerclient_connectorEPSS score0.37%
Anti-tampering protection of the Zscaler Client Connector can be bypassed under certain conditions when running the Repair App functionality. This affects Zscaler Client Connector on Windows prior to 4.2.1CVE-2024-23483zscalerclient_connectorEPSS score0.75%
An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection. This issue affects Zscaler Client Connector on MacOS <4.2.CVE-2024-23456zscalerclient_connectorEPSS score0.23%
Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with anti-tampering enabled.CVE-2024-23461zscalerclient_connectorEPSS score0.11%
An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS during the upgrade process may allow a Local Execution of Code.This issue affects Client Connector on MacOS: before 3.4.CVE-2024-23458zscalerclient_connectorEPSS score0.11%
While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privilege escalation. This issue affects Zscaler Client Connector on Windows <4.2.0.190.