Zscaler Client Connector
44 CVEs affecting Zscaler Client Connector. Latest disclosed: 2026-09-14. Critical: 2, High: 26.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-59568 | Critical | 9.1 | 2026-08-24 | Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability… |
CVE-2026-59564 | Critical | 9.1 | 2026-08-24 | An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal. |
CVE-2026-59567 | High | 8.8 | 2026-08-24 | Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute… |
CVE-2026-59565 | High | 8.8 | 2026-08-24 | A remotely exploitable buffer overflow bug can cause a local and kernel denial-of-service attack on affected versions of Zscaler Client Connector on Windows. |
CVE-2024-23463 | High | 8.8 | 2024-04-30 | Anti-tampering protection of the Zscaler Client Connector can be bypassed under certain conditions when running the Repair App functionality. This affects Zsca… |
CVE-2026-59566 | High | 8.4 | 2026-08-24 | A locally exploitable buffer overflow bug can cause a local denial-of-service attack on affected versions of Zscaler Client Connector on Android and ChromeOS. |
CVE-2023-28804 | High | 8.2 | 2023-10-23 | An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Clien… |
CVE-2023-28799 | High | 8.2 | 2023-06-22 | A URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this parameter, which would redirect the user aft… |
CVE-2026-59569 | High | 8.1 | 2026-09-14 | An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls. |
CVE-2026-25687 | High | 8.1 | 2026-09-14 | A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (c… |
CVE-2023-28800 | High | 8.1 | 2023-06-22 | When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login. |
CVE-2024-23456 | High | 7.8 | 2024-08-06 | Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with anti-tampering enab… |
CVE-2024-23457 | High | 7.8 | 2024-05-01 | The anti-tampering functionality of the Zscaler Client Connector can be disabled under certain conditions when an uninstall password is enforced. This affects… |
CVE-2023-28795 | High | 7.8 | 2023-10-23 | Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process. This issue affects Zscaler Client Conn… |
CVE-2023-28793 | High | 7.8 | 2023-10-23 | Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connect… |
CVE-2021-26738 | High | 7.8 | 2023-10-23 | Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local adversary may be able to execute code… |
CVE-2026-59570 | High | 7.5 | 2026-09-14 | On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture. |
CVE-2024-23480 | High | 7.5 | 2024-05-01 | A fallback mechanism in code sign checking on macOS may allow arbitrary code execution. This issue affects Zscaler Client Connector on MacOS prior to 4.2. |
CVE-2024-31127 | High | 7.3 | 2025-06-04 | An improper verification of a loaded library in Zscaler Client Connector on Mac < 4.2.0.241 may allow a local attacker to elevate their privileges. |
CVE-2024-23458 | High | 7.3 | 2024-08-06 | While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privile… |