Zscaler Client Connector EUVD-2026-64881

The CVSS vector specifies PR:L (low privilege required), meaning the attacker must possess some form of authenticated or credentialed access - such as a valid user account on the network or an authenticated session - rather than being a fully unauthenticated external party. The endpoint must be running an affected (unpatched) version of Zscaler Client Connector on Windows; the vulnerability does not affect non-Windows platforms per available data. No special non-default configuration appears required based on the description and AC:L. What limits exploitation: the PR:L requirement prevents fully anonymous internet-facing attacks, reducing the realistic attacker pool to authenticated insiders, post-phishing compromised accounts, or attackers who have already established a foothold. The specific Client Connector feature, protocol port, or parsing routine that triggers the overflow is not disclosed in available data, which limits reliability of exploitation without reverse engineering.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) classifies this as a high-severity remotely exploitable vulnerability requiring only low privilege, yet several signals warrant scrutiny. First, the vendor description limits stated impact to 'local and kernel denial-of-service,' directly contradicting C:H and I:H in the CVSS - this discrepancy is either vendor understatement (common with buffer overflows that can be upgraded to RCE) or CVSS overstatement; security teams must treat the higher bound as plausible until vendor confirmation. Second, no EPSS data was provided, making statistical exploitation probability unavailable; the absence of a KEV listing and any known POC suggests exploitation is not currently widespread. Third, Client Connector runs on managed corporate endpoints, meaning attackers exploiting this remotely (AV:N) still need PR:L access - likely meaning a network-authenticated session or VPN context - which limits opportunistic mass exploitation but does not eliminate insider-threat or post-phishing scenarios. The SSVC lens: exploitation status is 'none' publicly, technical impact is kernel-level (potentially 'total' if C:H/I:H materializes), and the product is automatable via network. Real-world priority is elevated for organizations with large Zscaler deployments until a patched version is confirmed deployed.

An authenticated attacker on the same network - or a remote attacker who has obtained low-privilege credentials - sends a specially crafted packet or payload targeting a parsing routine in the Zscaler Client Connector agent on a Windows endpoint. The malformed input triggers a buffer overflow that corrupts kernel memory, causing a Blue Screen of Death (BSOD) and system crash. No public proof-of-concept exploit has been identified, but the kernel-level impact and network attack vector make this a viable target for post-compromise lateral movement or disruption in organizations heavily reliant on Zscaler for traffic brokering.