EUVD-2026-77540
GHSA-cj79-f7p8-r2fv
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
Primary rating from Vendor (Zscaler) · only source for this CVE.
CVSS VectorVendor: Zscaler
Lifecycle Timeline
2DescriptionCVE.org
On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture.
AnalysisAI
A pre-installed peer application on the same device can abuse the Zscaler Client Connector to tear down the Zscaler tunnel, force the user to be logged out, and toggle packet capture on affected ChromeOS and Android builds prior to 4.2.0.152. The flaw is rated CVSS 7.5 with a local attack vector, high complexity and low privileges, reflecting that an attacker must already have a separate app installed on the managed endpoint rather than reaching the connector over the network. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Client Connector
View allDHCP can add routes to a client’s routing table via the classless static route option (121). Rated high severity (CVSS 7
An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection.2. Rated cri
An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allow
A fallback mechanism in code sign checking on macOS may allow arbitrary code execution.2. Rated critical severity (CVSS
An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation.4.0.105. Rat
Remote code execution in Zscaler Client Connector (ZCC) lets a remote, unauthenticated attacker run arbitrary code withi
Authentication bypass in Zscaler Client Connector allows remote unauthenticated attackers to subvert the trust between t
Remote buffer overflow in Zscaler Client Connector on Windows enables a network-accessible attacker with low privileges
Local privilege escalation in Zscaler Client Connector enables a standard (non-administrative) local user to execute arb
Buffer overflow in Zscaler Client Connector on Android and ChromeOS allows local exploitation to trigger a denial-of-ser
An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to pot
We need to produce a JSON object with the specified fields. Let me synthesize. CVE-2026-25687: race condition in ZPA tu
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today