Zscaler MCP Server CVE-2026-59563

Requires an authenticated MCP client or agent (PR:L) already interacting with the Zscaler MCP Server's confirmation-token workflow and possessing a valid HMAC confirmation token for a delete operation on affected services (ZPA, ZIA, or ZTW). The specific enabling defect is that delete operations passed empty parameters ({}) to check_confirmation(), so the resulting HMAC-SHA256 tokens are fungible and replayable across any other resource of the same type. Limiting factors: exploitation is confined to same-type resources, needs prior authenticated access and a legitimately issued token (UI:R), and affects only versions 0.7.0/0.7.1 - patched in 0.7.2, which binds the specific resource identifier into the HMAC payload.

This is a genuinely moderate-to-low real-world risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L, base 4.6) tells a coherent story: exploitation requires an already-authenticated MCP client/agent (PR:L) holding a valid confirmation token, some interaction from the agent workflow (UI:R), and yields only partial integrity and availability impact with NO confidentiality loss (C:N). There is no EPSS score, no CISA KEV listing, and no public exploit code provided - so this is 'no public exploit identified at time of analysis'. This is NOT a high-CVSS-but-hyped issue; it is correctly scored low. Two signals conflict with the input metadata: (1) the input Tag 'Information Disclosure' contradicts the CVSS vector's C:N - this is an integrity/availability weakness (unauthorized cross-resource deletion via replayed confirmation tokens), not disclosure; (2) NVD assigns CWE-305 (Authentication Bypass by Primary Weakness) while the vendor's own fix PR describes it as CWE-345 (Insufficient Verification of Data Authenticity), which better matches the 'HMAC token not bound to resource' root cause. The vulnerability is vendor-self-reported and fully patched in 0.7.2, further reducing urgency.

An authenticated operator or AI agent using the Zscaler MCP Server obtains a valid HMAC-SHA256 confirmation token for a legitimate delete operation on one resource (e.g. a specific ZPA/ZIA/ZTW object). Because the token is generated from empty parameters and is not bound to a resource identifier, the client replays that same token against a different resource of the same type to confirm and execute an unintended deletion. No public exploit code is identified; exploitation requires existing authenticated access to the MCP server and its confirmation workflow.