EUVD-2026-82928
GHSA-4j5q-5jhc-9378
Severity by source
AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Agrees with vendor: rare non-deterministic trigger gives AC:H, traffic must traverse an enterprise tenant so PR:L/UI:R, and bypass of a protective control affecting the org yields S:C with limited C/I impact.
Primary rating from Vendor (Zscaler).
CVSS VectorVendor: Zscaler
Lifecycle Timeline
2DescriptionCVE.org
A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances.
AnalysisAI
Policy evasion in Zscaler Internet Access File Type Control can allow a file to be improperly evaluated or attributed, potentially bypassing file-type enforcement in rare circumstances. The issue affects organizations using ZIA with File Type Control actively enforcing policies and requires a malicious file transfer through the ZIA tenant, low privileges (PR:L), and user interaction (UI:R). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target organization uses Zscaler Internet Access with the File Type Control feature actively enforcing policies, and that the malicious file transfer traverses that ZIA tenant. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue despite being a security-control weakness. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Treat this as vendor-managed remediation: Zscaler operates ZIA as a hosted service and applies corrective updates centrally, so customers should not expect an on-premises patch; monitor Zscaler's release/upgrade summary 2026 (https://help.zscaler.com/zia/release-upgrade-summary-2026) and confirm service updates are in effect. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today