EUVD-2026-77540
GHSA-cj79-f7p8-r2fv
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
A pre-installed peer application on the same device can abuse the Zscaler Client Connector to tear down the Zscaler tunnel, force the user to be logged out, and toggle packet capture on affected ChromeOS and Android builds prior to 4.2.0.152. The flaw is rated CVSS 7.5 with a local attack vector, high complexity and low privileges, reflecting that an attacker must already have a separate app installed on the managed endpoint rather than reaching the connector over the network. No public exploit code or active exploitation has been identified, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', so this is primarily an endpoint-hardening and asset-inventory concern rather than an urgent patch-emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Client Connector gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
Primary rating from Vendor (Zscaler) · only source for this CVE.
CVSS VectorVendor: Zscaler
DescriptionCVE.org
On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Client Connector
View allDHCP can add routes to a client’s routing table via the classless static route option (121). Rated high severity (CVSS 7
An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection.2. Rated cri
An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allow
A fallback mechanism in code sign checking on macOS may allow arbitrary code execution.2. Rated critical severity (CVSS
An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation.4.0.105. Rat
Remote code execution in Zscaler Client Connector (ZCC) lets a remote, unauthenticated attacker run arbitrary code withi
Authentication bypass in Zscaler Client Connector allows remote unauthenticated attackers to subvert the trust between t
Remote buffer overflow in Zscaler Client Connector on Windows enables a network-accessible attacker with low privileges
Local privilege escalation in Zscaler Client Connector enables a standard (non-administrative) local user to execute arb
Buffer overflow in Zscaler Client Connector on Android and ChromeOS allows local exploitation to trigger a denial-of-ser
Heap corruption triggered by a race condition in the Zscaler Client Connector (ZCC) ZPA tunnel handler allows remote, un
Improper input validation in Zscaler Client Connector for Android and ChromeOS (builds prior to 4.2.0.152) lets an attac
Exploit-DB