What is the CVSS score of CVE-2026-22567?

CVE-2026-22567 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Zscaler Internet Access Admin Portal are affected by CVE-2026-22567?

CVE-2026-22567 is a high-severity vulnerability in ZIA Admin UI that could allow authenticated administrators to execute unauthorized backend functions through manipulated input fields.

How to fix or mitigate CVE-2026-22567?

Within 24 hours: inventory all ZIA Admin UI users and validate that only authorized personnel retain admin access; restrict admin UI access to trusted IP ranges via network controls. Within 7 days: implement input validation monitoring and WAF rules to block malicious payloads targeting the vulnerable input fields; document the specific vulnerable fields from vendor advisories. Within 30 days: establish a tracking mechanism for patch availability; conduct a security review of admin UI access logs for anomalies; plan for immediate deployment once the patch is released.

Zscaler Internet Access Admin Portal CVE-2026-22567

HIGH

Improper Input Validation (CWE-20)

2026-02-23 cve@zscaler.com

Code Injection Zscaler Internet Access Admin Portal

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 23, 2026 - 17:23 nvd

HIGH 7.6

DescriptionCVE.org

Improper validation of user-supplied input in the ZIA Admin UI could allow an authenticated administrator to initiate backend functions through specific input fields in limited scenarios.

AnalysisAI

Zscaler Internet Access Admin Portal allows authenticated administrators to execute arbitrary backend functions through insufficient input validation in the web UI. This high-severity vulnerability requires administrative privileges and currently lacks a patch, limiting exposure but leaving affected organizations vulnerable until remediation is available. An attacker with admin credentials could bypass intended restrictions to perform unauthorized backend operations with cross-system impact.

Technical ContextAI

Classified as CWE-20 (Improper Input Validation). Affects Zscaler Internet Access Admin Portal. Improper validation of user-supplied input in the ZIA Admin UI could allow an authenticated administrator to initiate backend functions through specific input fields in limited scenarios.