Zscaler Client Connector CVE-2026-25687

Exploitation requires triggering a race condition (CWE-366) in the ZPA tunnel handler of ZCC, so the attacker must be able to inject or influence timing-sensitive traffic within the ZPA tunnel path and repeatedly attempt to win the race - reflected in CVSS AC:H and SSVC Automatable:no. Limiting factors: the race is inherently non-deterministic and hard to win reliably (making the confirmed outcome a client crash rather than dependable code execution), only ZCC versions below 4.6.0.486 / 4.7.0.350 / 4.8.0.267 / 4.9.0.412 are affected, and reaching RCE additionally depends on successful heap grooming that is not publicly demonstrated. No authentication or user interaction is required per the vector (PR:N/UI:N).

This is a genuinely high-severity but low-immediacy issue whose signals are internally consistent and do NOT support treating it as an emergency. The CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) rates confidentiality/integrity/availability all High by assuming the heap corruption escalates to arbitrary code execution - but the description only CONFIRMS a denial of service (client crash) and states RCE is merely 'potentially' achievable, so the C:H/I:H are aspirational rather than demonstrated. All exploitation signals point to low real-world risk: EPSS is 0.23% (14th percentile), SSVC records Exploitation:none and Automatable:no (consistent with the AC:H race-condition requirement, which is hard to win reliably), there is no CISA KEV listing and no public exploit code. The one factor that raises this above a routine patch is Technical Impact:total (full compromise of the ZCC process if RCE is realized) combined with the product being a ubiquitously-deployed endpoint agent. Net: no public exploit identified at time of analysis; prioritize patching on a normal-to-elevated endpoint-fleet cadence rather than as an actively-exploited zero-day.

An attacker in a position to feed traffic into the ZPA tunnel (e.g., a malicious or compromised endpoint reachable through the tunnel, or an on-path adversary) sends specially timed data to the ZCC ZPA tunnel handler to win a race and corrupt the heap. In the reliable case the ZCC process crashes, dropping the user's secure access; with precise heap grooming the corruption could theoretically be steered toward code execution in the ZCC process context. No public proof-of-concept exists and the AC:H race makes reliable triggering difficult.