Client Connector
Monthly
A pre-installed peer application on the same device can abuse the Zscaler Client Connector to tear down the Zscaler tunnel, force the user to be logged out, and toggle packet capture on affected ChromeOS and Android builds prior to 4.2.0.152. The flaw is rated CVSS 7.5 with a local attack vector, high complexity and low privileges, reflecting that an attacker must already have a separate app installed on the managed endpoint rather than reaching the connector over the network. No public exploit code or active exploitation has been identified, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', so this is primarily an endpoint-hardening and asset-inventory concern rather than an urgent patch-emergency.
Improper input validation in Zscaler Client Connector for Android and ChromeOS (builds prior to 4.2.0.152) lets an attacker with elevated local privileges on the endpoint feed malformed input to the connector and bypass Zscaler's traffic inspection and access controls, with a CVSS 8.1 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L) rating that reflects total loss of the security control's integrity. The flaw is not remotely exploitable and requires high privileges (root or equivalent device-admin context) on the affected Android or ChromeOS device, and there is no public exploit identified at time of analysis. EPSS is 0.12% (2nd percentile) and CISA SSVC records exploitation 'none', automatable 'no' with total technical impact — a low-likelihood, patch-promptly issue rather than an emergency.
Heap corruption triggered by a race condition in the Zscaler Client Connector (ZCC) ZPA tunnel handler allows remote, unauthenticated attackers to crash the client process and, under conditions requiring successful heap grooming, potentially execute code in the context of that process. Only ZCC builds below 4.6.0.486, 4.7.0.350, 4.8.0.267 and 4.9.0.412 are affected, and the practical outcome is more reliably a denial-of-service (client crash) than dependable code execution because the underlying race is non-deterministic and hard to win. No public exploit has been identified at time of analysis and the risk is low-immediacy (EPSS ~0.23%, 14th percentile; SSVC Exploitation: none, Automatable: no), despite the vendor's CVSS 8.1 rating.
Remote code execution in Zscaler Client Connector (ZCC) lets a remote, unauthenticated attacker run arbitrary code within the ZCC process context, per a vendor-reported (Zscaler) advisory carrying a CVSS 9.1 rating. The flaw stems from improper input validation (CWE-20) and requires no privileges or user interaction, though exact fixed versions are described only through Zscaler's release summary rather than a discrete CVE-pinned build. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in Zscaler Client Connector enables a standard (non-administrative) local user to execute arbitrary code in a privileged context via multiple improper privilege handling flaws (CWE-280). The scope change captured in the CVSS vector (S:C) reflects that exploitation breaks the security boundary of the Client Connector's privileged agent process, extending impact beyond the attacker's initial user context to full High-rated confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Buffer overflow in Zscaler Client Connector on Android and ChromeOS allows local exploitation to trigger a denial-of-service condition against the connector process. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) assigns High confidentiality and integrity impact, creating a notable discrepancy with the vendor description, which characterizes impact as DoS only - this gap suggests the vulnerability may carry latent code-execution potential that the description does not fully disclose. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote buffer overflow in Zscaler Client Connector on Windows enables a network-accessible attacker with low privileges to crash the local system at the kernel level, producing a denial-of-service condition. The provided CVSS vector (C:H/I:H/A:H) signals potential confidentiality and integrity impact beyond what the vendor description explicitly states, a discrepancy that warrants verification - kernel-level buffer overflows frequently allow code execution, not merely DoS. No public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Zscaler Client Connector allows remote unauthenticated attackers to subvert the trust between the endpoint agent and the Zscaler Client Connector Portal, per the CVSS vector (AV:N/PR:N) yielding high confidentiality and integrity impact. The flaw (CWE-304) stems from a missing or incorrect step in the authentication logic governing agent-to-portal communications, affecting Windows, macOS, Linux, iOS, Android, and ChromeOS builds below the fixed versions. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though its 9.1 base score and network-facing, no-privilege profile make it high priority.
An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privilege escalation.2.0.190. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Anti-tampering can be disabled under certain conditions without signature validation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
DHCP can add routes to a client’s routing table via the classless static route option (121). Rated high severity (CVSS 7.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS allows a denial of service of the Client Connector binary and thus removing client functionality.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS during the upgrade process may allow a Local Execution of Code.4. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allows a system file to be overwritten.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A fallback mechanism in code sign checking on macOS may allow arbitrary code execution.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The anti-tampering functionality of the Zscaler Client Connector can be disabled under certain conditions when an uninstall password is enforced. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Anti-tampering protection of the Zscaler Client Connector can be bypassed under certain conditions when running the Repair App functionality. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The ZScaler service is susceptible to a local privilege escalation vulnerability found in the ZScalerService process. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service restart from Zscaler. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse.3.1.6. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation.4.0.105. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.4.0.105. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypass.9. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection.3.1.6. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process.3.1.6. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection.3.1.6. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A URL parameter during login flow was vulnerable to injection. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A pre-installed peer application on the same device can abuse the Zscaler Client Connector to tear down the Zscaler tunnel, force the user to be logged out, and toggle packet capture on affected ChromeOS and Android builds prior to 4.2.0.152. The flaw is rated CVSS 7.5 with a local attack vector, high complexity and low privileges, reflecting that an attacker must already have a separate app installed on the managed endpoint rather than reaching the connector over the network. No public exploit code or active exploitation has been identified, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', so this is primarily an endpoint-hardening and asset-inventory concern rather than an urgent patch-emergency.
Improper input validation in Zscaler Client Connector for Android and ChromeOS (builds prior to 4.2.0.152) lets an attacker with elevated local privileges on the endpoint feed malformed input to the connector and bypass Zscaler's traffic inspection and access controls, with a CVSS 8.1 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L) rating that reflects total loss of the security control's integrity. The flaw is not remotely exploitable and requires high privileges (root or equivalent device-admin context) on the affected Android or ChromeOS device, and there is no public exploit identified at time of analysis. EPSS is 0.12% (2nd percentile) and CISA SSVC records exploitation 'none', automatable 'no' with total technical impact — a low-likelihood, patch-promptly issue rather than an emergency.
Heap corruption triggered by a race condition in the Zscaler Client Connector (ZCC) ZPA tunnel handler allows remote, unauthenticated attackers to crash the client process and, under conditions requiring successful heap grooming, potentially execute code in the context of that process. Only ZCC builds below 4.6.0.486, 4.7.0.350, 4.8.0.267 and 4.9.0.412 are affected, and the practical outcome is more reliably a denial-of-service (client crash) than dependable code execution because the underlying race is non-deterministic and hard to win. No public exploit has been identified at time of analysis and the risk is low-immediacy (EPSS ~0.23%, 14th percentile; SSVC Exploitation: none, Automatable: no), despite the vendor's CVSS 8.1 rating.
Remote code execution in Zscaler Client Connector (ZCC) lets a remote, unauthenticated attacker run arbitrary code within the ZCC process context, per a vendor-reported (Zscaler) advisory carrying a CVSS 9.1 rating. The flaw stems from improper input validation (CWE-20) and requires no privileges or user interaction, though exact fixed versions are described only through Zscaler's release summary rather than a discrete CVE-pinned build. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in Zscaler Client Connector enables a standard (non-administrative) local user to execute arbitrary code in a privileged context via multiple improper privilege handling flaws (CWE-280). The scope change captured in the CVSS vector (S:C) reflects that exploitation breaks the security boundary of the Client Connector's privileged agent process, extending impact beyond the attacker's initial user context to full High-rated confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Buffer overflow in Zscaler Client Connector on Android and ChromeOS allows local exploitation to trigger a denial-of-service condition against the connector process. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) assigns High confidentiality and integrity impact, creating a notable discrepancy with the vendor description, which characterizes impact as DoS only - this gap suggests the vulnerability may carry latent code-execution potential that the description does not fully disclose. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote buffer overflow in Zscaler Client Connector on Windows enables a network-accessible attacker with low privileges to crash the local system at the kernel level, producing a denial-of-service condition. The provided CVSS vector (C:H/I:H/A:H) signals potential confidentiality and integrity impact beyond what the vendor description explicitly states, a discrepancy that warrants verification - kernel-level buffer overflows frequently allow code execution, not merely DoS. No public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Zscaler Client Connector allows remote unauthenticated attackers to subvert the trust between the endpoint agent and the Zscaler Client Connector Portal, per the CVSS vector (AV:N/PR:N) yielding high confidentiality and integrity impact. The flaw (CWE-304) stems from a missing or incorrect step in the authentication logic governing agent-to-portal communications, affecting Windows, macOS, Linux, iOS, Android, and ChromeOS builds below the fixed versions. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though its 9.1 base score and network-facing, no-privilege profile make it high priority.
An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privilege escalation.2.0.190. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Anti-tampering can be disabled under certain conditions without signature validation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
DHCP can add routes to a client’s routing table via the classless static route option (121). Rated high severity (CVSS 7.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS allows a denial of service of the Client Connector binary and thus removing client functionality.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS during the upgrade process may allow a Local Execution of Code.4. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allows a system file to be overwritten.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A fallback mechanism in code sign checking on macOS may allow arbitrary code execution.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The anti-tampering functionality of the Zscaler Client Connector can be disabled under certain conditions when an uninstall password is enforced. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Anti-tampering protection of the Zscaler Client Connector can be bypassed under certain conditions when running the Repair App functionality. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The ZScaler service is susceptible to a local privilege escalation vulnerability found in the ZScalerService process. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service restart from Zscaler. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse.3.1.6. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation.4.0.105. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.4.0.105. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypass.9. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection.3.1.6. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process.3.1.6. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection.3.1.6. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A URL parameter during login flow was vulnerable to injection. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.