Zscaler vulnerabilities, page 2
58 vulnerabilities
Known vulnerabilities in Zscaler products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 11 products.
CVE-2024-23460zscalerclient_connector
EPSS score0.13%
The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This affects Zscaler Client Connector on MacOS <4.2.CVE-2024-23464zscalerclient_connectorEPSS score0.43%
In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows <4.2.1CVE-2024-23457zscalerclient_connectorEPSS score0.20%
The anti-tampering functionality of the Zscaler Client Connector can be disabled under certain conditions when an uninstall password is enforced. This affects Zscaler Client Connector on Windows prior to 4.2.0.209CVE-2024-23480zscalerclient_connectorEPSS score0.30%
A fallback mechanism in code sign checking on macOS may allow arbitrary code execution. This issue affects Zscaler Client Connector on MacOS prior to 4.2.CVE-2024-23462zscalerclient_connectorEPSS score0.19%
An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS allows a denial of service of the Client Connector binary and thus removing client functionality.This issue affects Client Connector on MacOS: before 3.4.CVE-2026-59569zscalerclient_connectorEPSS score0.18%
An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls.CVE-2026-59564zscalerclient_connectorEPSS score0.53%
An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal.CVE-2026-59566zscalerclient_connectorEPSS score0.18%
A locally exploitable buffer overflow bug can cause a local denial-of-service attack on affected versions of Zscaler Client Connector on Android and ChromeOS.CVE-2026-59565zscalerclient_connectorEPSS score0.48%
A remotely exploitable buffer overflow bug can cause a local and kernel denial-of-service attack on affected versions of Zscaler Client Connector on Windows.CVE-2026-59567zscalerclient_connectorEPSS score0.15%
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in a privileged context.CVE-2026-59568zscalerclient_connectorEPSS score0.66%
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context.CVE-2026-59570zscalerclient_connectorEPSS score0.13%
On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture.CVE-2026-59563zscalerzscaler-mcp-serverEPSS score0.13%
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2.CVE-2026-25687zscalerclient_connectorEPSS score0.38%
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.CVE-2026-22569zscalerclient_connector+1EPSS score0.18%
An incorrect startup configuration of affected versions of Zscaler Client Connector on Windows may cause a limited amount of traffic from being inspected under rare circumstances.CVE-2026-22568zscalerzia admin ui+1EPSS score0.17%
Improper neutralization of special elements in user-supplied input within the ZIA Admin UI could allow an authenticated administrator to access or retrieve unauthorized internal information in rare conditions.CVE-2026-22567zscalerzia admin ui+1EPSS score0.20%
Improper validation of user-supplied input in the ZIA Admin UI could allow an authenticated administrator to initiate backend functions through specific input fields in limited scenarios.CVE-2023-41973zscalerclient_connectorEPSS score0.31%
ZSATray passes the previousInstallerName as a config parameter to TrayManager, and TrayManager constructs the path and appends previousInstallerName to get the full path of the exe. Fixed Version: Win ZApp 4.3.0.121 and later.CVE-2023-41969zscalerclient_connectorEPSS score0.31%
An arbitrary file deletion in ZSATrayManager where it protects the temporary encrypted ZApp issue reporting file from the unprivileged end user access and modification. Fixed version: Win ZApp 4.3.0 and later.CVE-2023-41971zscalerclient_connectorEPSS score0.19%
An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Windows allows a system file to be overwritten.This issue affects Client Connector on Windows: before 3.7.