EUVD-2026-64884
GHSA-m6h7-qfgx-p2gj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated, low-complexity network RCE justifies AV:N/AC:L/PR:N/UI:N with high C/I; I set A:H because arbitrary code execution normally impacts availability, unlike the vendor's A:N.
Primary rating from Vendor (Zscaler).
CVSS VectorVendor: Zscaler
Lifecycle Timeline
2DescriptionCVE.org
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context.
AnalysisAI
Remote code execution in Zscaler Client Connector (ZCC) lets a remote, unauthenticated attacker run arbitrary code within the ZCC process context, per a vendor-reported (Zscaler) advisory carrying a CVSS 9.1 rating. The flaw stems from improper input validation (CWE-20) and requires no privileges or user interaction, though exact fixed versions are described only through Zscaler's release summary rather than a discrete CVE-pinned build. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, elevated privileges, or user interaction is required, and the description explicitly states an unauthenticated, unprivileged user can trigger it - the prerequisite is network reachability to a device running an affected version of Zscaler Client Connector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals point to a genuinely high-priority issue but with important gaps. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Zscaler Client Connector to the fixed release identified in Zscaler's Client Connector app release summary (https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2026); an exact CVE-pinned fixed version number is not provided in the input, so patch to the latest release listed there and treat it as 'patch available per vendor advisory.' Because ZCC is centrally managed, push the updated build through the Zscaler admin portal / MDM to enforce the minimum approved app version across the fleet rather than relying on per-device updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running Zscaler Client Connector and assess which are business-critical (finance, healthcare, government, energy sectors face highest exploitation risk). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Client Connector
View allDHCP can add routes to a client’s routing table via the classless static route option (121). Rated high severity (CVSS 7
An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection.2. Rated cri
An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allow
A fallback mechanism in code sign checking on macOS may allow arbitrary code execution.2. Rated critical severity (CVSS
An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation.4.0.105. Rat
Authentication bypass in Zscaler Client Connector allows remote unauthenticated attackers to subvert the trust between t
Remote buffer overflow in Zscaler Client Connector on Windows enables a network-accessible attacker with low privileges
Local privilege escalation in Zscaler Client Connector enables a standard (non-administrative) local user to execute arb
Buffer overflow in Zscaler Client Connector on Android and ChromeOS allows local exploitation to trigger a denial-of-ser
Anti-tampering protection of the Zscaler Client Connector can be bypassed under certain conditions when running the Repa
The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrar
While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks,
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today