EUVD-2026-77536
GHSA-4wwc-hgc4-j27v
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Zscaler) · only source for this CVE.
CVSS VectorVendor: Zscaler
Lifecycle Timeline
3DescriptionCVE.org
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.
AnalysisAI
We need to produce a JSON object with the specified fields. Let me synthesize. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Client Connector
View allDHCP can add routes to a client’s routing table via the classless static route option (121). Rated high severity (CVSS 7
An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection.2. Rated cri
An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allow
A fallback mechanism in code sign checking on macOS may allow arbitrary code execution.2. Rated critical severity (CVSS
An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation.4.0.105. Rat
Remote code execution in Zscaler Client Connector (ZCC) lets a remote, unauthenticated attacker run arbitrary code withi
Authentication bypass in Zscaler Client Connector allows remote unauthenticated attackers to subvert the trust between t
Remote buffer overflow in Zscaler Client Connector on Windows enables a network-accessible attacker with low privileges
Local privilege escalation in Zscaler Client Connector enables a standard (non-administrative) local user to execute arb
Buffer overflow in Zscaler Client Connector on Android and ChromeOS allows local exploitation to trigger a denial-of-ser
An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to pot
Anti-tampering protection of the Zscaler Client Connector can be bypassed under certain conditions when running the Repa
Same weakness CWE-366 – Race Condition within a Thread
View allShare
External POC / Exploit Code
Leaving vuln.today