Zscaler

Latest CVEs · RSS

• CVE-2026-59563 2026-09-28 · CVSS 4.6
  Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client
• CVE-2026-25684 2026-09-18 · CVSS 4.4
  A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare
• CVE-2026-59570 2026-09-14 · CVSS 7.5
  On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture.
• CVE-2026-59569 2026-09-14 · CVSS 8.1
  An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls.
• CVE-2026-25687 2026-09-14 · CVSS 8.1
  A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (cl
• CVE-2026-59568 2026-08-24 · CVSS 9.1
  Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability
• CVE-2026-59567 2026-08-24 · CVSS 8.8
  Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute a
• CVE-2026-59566 2026-08-24 · CVSS 8.4
  A locally exploitable buffer overflow bug can cause a local denial-of-service attack on affected versions of Zscaler Client Connector on Android and ChromeOS.
• CVE-2026-59565 2026-08-24 · CVSS 8.8
  A remotely exploitable buffer overflow bug can cause a local and kernel denial-of-service attack on affected versions of Zscaler Client Connector on Windows.
• CVE-2026-59564 2026-08-24 · CVSS 9.1
  An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal.
• CVE-2026-22569 2026-03-31 · CVSS 5.4
  An incorrect startup configuration of affected versions of Zscaler Client Connector on Windows may cause a limited amount of traffic from being inspected under
• CVE-2026-22567 2026-02-23 · CVSS 7.6
  Improper validation of user-supplied input in the ZIA Admin UI could allow an authenticated administrator to initiate backend functions through specific input f
• CVE-2026-22568 2026-02-23 · CVSS 5.5
  Improper neutralization of special elements in user-supplied input within the ZIA Admin UI could allow an authenticated administrator to access or retrieve unau
• CVE-2025-54983 2025-11-12 · CVSS 5.2
  A health check port on Zscaler Client Connector on Windows, versions 4.6 < 4.6.0.216 and 4.7 < 4.7.0.47, which under specific circumstances was not released af
• CVE-2025-54982 2025-08-05 · CVSS 9.6
  An improper verification of cryptographic signature in Zscaler's SAML authentication mechanism on the server-side allowed an authentication abuse.
• CVE-2024-31127 2025-06-04 · CVSS 7.3
  An improper verification of a loaded library in Zscaler Client Connector on Mac < 4.2.0.241 may allow a local attacker to elevate their privileges.
• CVE-2023-28806 2024-08-06 · CVSS 5.7
  An Improper Validation of signature in Zscaler Client Connector on Windows allows an authenticated user to disable anti-tampering. This issue affects Client Con
• CVE-2024-23483 2024-08-06 · CVSS 7.0
  An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection. This issue affects Zscaler Client Connector on MacO
• CVE-2024-23460 2024-08-06 · CVSS 6.4
  The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This affe
• CVE-2024-23464 2024-08-06 · CVSS 7.2
  In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows <4.2.
• CVE-2024-23458 2024-08-06 · CVSS 7.3
  While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privileg
• CVE-2024-23456 2024-08-06 · CVSS 7.8
  Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with anti-tampering enabl
• CVE-2024-23462 2024-05-02 · CVSS 3.3
  An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS allows a denial of service of the Client Connector binary and
• CVE-2024-23461 2024-05-02 · CVSS 4.2
  An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS during the upgrade process may allow a Local Execution of Cod
• CVE-2024-23459 2024-05-02 · CVSS 7.1
  An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allows a system file to be overwritten.This i