Zscaler
43 CVEs across 10 Zscaler products. Browse Zscaler vulnerabilities, severities, and proof-of-concept exploits.
Zscaler products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-22569 | Medium | 5.4 | 2026-03-31 | An incorrect startup configuration of affected versions of Zscaler Client Connector on Windows may cause a limited amount of traffic from being inspected under… |
CVE-2026-22568 | Medium | 5.5 | 2026-02-23 | Improper neutralization of special elements in user-supplied input within the ZIA Admin UI could allow an authenticated administrator to access or retrieve una… |
CVE-2026-22567 | High | 7.6 | 2026-02-23 | Improper validation of user-supplied input in the ZIA Admin UI could allow an authenticated administrator to initiate backend functions through specific input… |
CVE-2025-54983 | Medium | 5.2 | 2025-11-12 | A health check port on Zscaler Client Connector on Windows, versions 4.6 < 4.6.0.216 and 4.7 < 4.7.0.47, which under specific circumstances was not released a… |
CVE-2025-54982 | Critical | 9.6 | 2025-08-05 | An improper verification of cryptographic signature in Zscaler's SAML authentication mechanism on the server-side allowed an authentication abuse. |
CVE-2024-31127 | High | 7.3 | 2025-06-04 | An improper verification of a loaded library in Zscaler Client Connector on Mac < 4.2.0.241 may allow a local attacker to elevate their privileges. |
CVE-2024-23483 | High | 7.0 | 2024-08-06 | An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection. This issue affects Zscaler Client Connector on Mac… |
CVE-2024-23464 | High | 7.2 | 2024-08-06 | In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows <4.2… |
CVE-2024-23460 | Medium | 6.4 | 2024-08-06 | The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This aff… |
CVE-2024-23458 | High | 7.3 | 2024-08-06 | While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privile… |
CVE-2024-23456 | High | 7.8 | 2024-08-06 | Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with anti-tampering enab… |
CVE-2023-28806 | Medium | 5.7 | 2024-08-06 | An Improper Validation of signature in Zscaler Client Connector on Windows allows an authenticated user to disable anti-tampering. This issue affects Client Co… |
CVE-2024-3661 | High | 7.6 | 2024-05-06 | DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traff… |
CVE-2024-23462 | Low | 3.3 | 2024-05-02 | An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS allows a denial of service of the Client Connector binary an… |
CVE-2024-23461 | Medium | 4.2 | 2024-05-02 | An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS during the upgrade process may allow a Local Execution of Co… |
CVE-2024-23459 | High | 7.1 | 2024-05-02 | An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allows a system file to be overwritten.This… |
CVE-2023-41971 | Medium | 5.3 | 2024-05-02 | An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Windows allows a system file to be overwritten.T… |
CVE-2023-41970 | Medium | 6.0 | 2024-05-02 | An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on Windows during the Repair App functionality may allow Local Execut… |
CVE-2023-28798 | Medium | 6.5 | 2024-05-02 | An out-of-bounds write to heap in the pacparser library on Zscaler Client Connector on Mac may lead to arbitrary code execution. |
CVE-2024-23480 | High | 7.5 | 2024-05-01 | A fallback mechanism in code sign checking on macOS may allow arbitrary code execution. This issue affects Zscaler Client Connector on MacOS prior to 4.2. |
CVE-2024-23457 | High | 7.8 | 2024-05-01 | The anti-tampering functionality of the Zscaler Client Connector can be disabled under certain conditions when an uninstall password is enforced. This affects… |
CVE-2024-23463 | High | 8.8 | 2024-04-30 | Anti-tampering protection of the Zscaler Client Connector can be bypassed under certain conditions when running the Repair App functionality. This affects Zsca… |
CVE-2024-23482 | High | 7.0 | 2024-03-26 | The ZScaler service is susceptible to a local privilege escalation vulnerability found in the ZScalerService process. Fixed Version: Mac ZApp 4.2.0.241 and lat… |
CVE-2023-41973 | High | 7.3 | 2024-03-26 | ZSATray passes the previousInstallerName as a config parameter to TrayManager, and TrayManager constructs the path and appends previousInstallerName to get the… |
CVE-2023-41972 | High | 7.3 | 2024-03-26 | In some rare cases, there is a password type validation missing in Revert Password check and for some features it could be disabled. Fixed Version: Win ZApp 4… |
CVE-2023-41969 | High | 7.3 | 2024-03-26 | An arbitrary file deletion in ZSATrayManager where it protects the temporary encrypted ZApp issue reporting file from the unprivileged end user access and modi… |
CVE-2023-28807 | Medium | 5.1 | 2024-01-31 | In Zscaler Internet Access (ZIA) a mismatch between Connect Host and Client Hello's Server Name Indication (SNI) enables attackers to evade network security co… |
CVE-2023-28802 | Medium | 4.9 | 2023-11-21 | An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the serv… |
CVE-2023-28794 | Medium | 4.3 | 2023-11-06 | Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse. This issue affects Zscaler Client Connector for Linux: befor… |
CVE-2023-28805 | Medium | 6.7 | 2023-10-23 | An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation. This issue affects Client Connector: before 1.4.0… |
CVE-2023-28804 | High | 8.2 | 2023-10-23 | An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Clien… |
CVE-2023-28803 | Medium | 5.9 | 2023-10-23 | An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypas… |
CVE-2023-28797 | Medium | 6.3 | 2023-10-23 | Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk. A malicious user can replace the folde… |
CVE-2023-28796 | High | 7.1 | 2023-10-23 | Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Co… |
CVE-2023-28795 | High | 7.8 | 2023-10-23 | Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process. This issue affects Zscaler Client Conn… |
CVE-2023-28793 | High | 7.8 | 2023-10-23 | Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connect… |
CVE-2021-26738 | High | 7.8 | 2023-10-23 | Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local adversary may be able to execute code… |
CVE-2021-26737 | Medium | 5.5 | 2023-10-23 | The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients. A local adversary without sufficient privileges may be able to s… |
CVE-2021-26736 | Medium | 6.7 | 2023-10-23 | Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged… |
CVE-2021-26735 | Medium | 6.7 | 2023-10-23 | The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversary may be able to ex… |
CVE-2021-26734 | Medium | 4.4 | 2023-10-23 | Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation. A local adversary may be a… |
CVE-2023-41717 | Medium | 5.5 | 2023-08-31 | Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local attackers to bypass file download/upload restrictions. |
CVE-2023-28801 | Critical | 9.6 | 2023-08-31 | An Improper Verification of Cryptographic Signature in the SAML authentication of the Zscaler Admin UI allows a Privilege Escalation.This issue affects Admin U… |
CVE-2023-28800 | High | 8.1 | 2023-06-22 | When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login. |
CVE-2023-28799 | High | 8.2 | 2023-06-22 | A URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this parameter, which would redirect the user aft… |
CVE-2020-11634 | High | 7.8 | 2021-07-15 | The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL. A local adversary may… |
CVE-2020-11632 | High | 7.8 | 2021-07-15 | The Zscaler Client Connector prior to 2.1.2.150 did not quote the search path for services, which allows a local adversary to execute code with system privileg… |
CVE-2020-11633 | Critical | 9.8 | 2021-07-15 | The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer overflow when connecting to misconfigured TLS servers. An adversary would p… |
CVE-2020-11635 | High | 7.8 | 2021-02-16 | The Zscaler Client Connector prior to 3.1.0 did not sufficiently validate RPC clients, which allows a local adversary to execute code with system privileges or… |