# Zscaler Client Connector. Every CVE that names Zscaler Client Connector among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Android ZCC denial of service](https://agentprime.io/advisories/CVE-2026-59570.md) `CVE-2026-59570` · CVE record: Zscaler Client Connector · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-20 - [Android ZCC VPN API method privilege escalation](https://agentprime.io/advisories/CVE-2026-59569.md) `CVE-2026-59569` · CVE record: Zscaler Client Connector · CVSS 8.1 High · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-20 - [ZCC race condition in ZPA tunnel handler](https://agentprime.io/advisories/CVE-2026-25687.md) `CVE-2026-25687` · CVE record: Zscaler Client Connector · CVSS 8.1 High · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-366 - [Remote Code Execution](https://agentprime.io/advisories/CVE-2026-59568.md) `CVE-2026-59568` · CVE record: Zscaler Client Connector · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-20 - [Local privilege escalation](https://agentprime.io/advisories/CVE-2026-59567.md) `CVE-2026-59567` · CVE record: Zscaler Client Connector · CVSS 8.8 High · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-280 - [Local denial-of-service](https://agentprime.io/advisories/CVE-2026-59566.md) `CVE-2026-59566` · CVE record: Zscaler Client Connector · CVSS 8.4 High · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-229 - [Local and kernel denial-of-service](https://agentprime.io/advisories/CVE-2026-59565.md) `CVE-2026-59565` · CVE record: Zscaler Client Connector · CVSS 8.8 High · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-229 - [Authentication bypass between ZCC and client connector portal](https://agentprime.io/advisories/CVE-2026-59564.md) `CVE-2026-59564` · CVE record: Zscaler Client Connector · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass - [Incorrect startup configuration in ZCC](https://agentprime.io/advisories/CVE-2026-22569.md) `CVE-2026-22569` · CVE record: Zscaler Zscaler Client Connector · CVSS 5.4 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: CWE-1289 - [Health check port on ZCC allows tunnel bypass](https://agentprime.io/advisories/CVE-2025-54983.md) `CVE-2025-54983` · CVE record: Zscaler Zscaler Client Connector · CVSS 5.2 Medium · Not analysed yet · Published 12 Nov 2025 · Tags: Denial of service - [MacOS Zscaler Client Connector Local Privilege Escalation](https://agentprime.io/advisories/CVE-2024-31127.md) `CVE-2024-31127` · CVE record: Zscaler Client Connector · CVSS 7.3 High · Not analysed yet · Published 4 Jun 2025 · Tags: CWE-346 - [Signature validation error in DLL allows disabling anti-tampering protection](https://agentprime.io/advisories/CVE-2023-28806.md) `CVE-2023-28806` · CVE record: Zscaler Client Connector · CVSS 5.7 Medium · Not analysed yet · Published 6 Aug 2024 · Tags: Weak cryptography or TLS - [Local Privilege Escalation via lack of input validation](https://agentprime.io/advisories/CVE-2024-23483.md) `CVE-2024-23483` · CVE record: Zscaler Client Connector · CVSS 7.0 High · Not analysed yet · Published 6 Aug 2024 · Tags: CWE-20 - [Incorrect signature validation of package](https://agentprime.io/advisories/CVE-2024-23460.md) `CVE-2024-23460` · CVE record: Zscaler Client Connector · CVSS 6.4 Medium · Not analysed yet · Published 6 Aug 2024 · Tags: Weak cryptography or TLS - [Zscaler bypass with administrative privileges on Windows](https://agentprime.io/advisories/CVE-2024-23464.md) `CVE-2024-23464` · CVE record: Zscaler Client Connector · CVSS 7.2 High · Not analysed yet · Published 6 Aug 2024 · Tags: CWE-281 - [Local Privilege Escalation on Zscaler Client Connector on Windows](https://agentprime.io/advisories/CVE-2024-23458.md) `CVE-2024-23458` · CVE record: Zscaler Client Connector · CVSS 7.3 High · Not analysed yet · Published 6 Aug 2024 · Tags: CWE-346 - [Signature validation issue leads to Anti-Tampering bypass](https://agentprime.io/advisories/CVE-2024-23456.md) `CVE-2024-23456` · CVE record: Zscaler Client Connector · CVSS 7.8 High · Not analysed yet · Published 6 Aug 2024 · Tags: Weak cryptography or TLS - [ZCC Mac validinstaller file integrity check missing](https://agentprime.io/advisories/CVE-2024-23462.md) `CVE-2024-23462` · CVE record: Zscaler Client Connector · CVSS 3.3 Low · Not analysed yet · Published 2 May 2024 · Tags: CWE-354 - [ZCC macOS Upgrade ZIP Bomb DoS](https://agentprime.io/advisories/CVE-2024-23461.md) `CVE-2024-23461` · CVE record: Zscaler Client Connector · CVSS 4.2 Medium · Not analysed yet · Published 2 May 2024 · Tags: CWE-354 - [Multiple Arbitrary Creates/Overwrites by link following](https://agentprime.io/advisories/CVE-2024-23459.md) `CVE-2024-23459` · CVE record: Zscaler Client Connector · CVSS 7.1 High · Not analysed yet · Published 2 May 2024 · Tags: Path traversal - [Windows ZCC Upgrade DoS And Privilege Escalation Through RPC Control](https://agentprime.io/advisories/CVE-2023-41971.md) `CVE-2023-41971` · CVE record: Zscaler Client Connector · CVSS 5.3 Medium · Not analysed yet · Published 2 May 2024 · Tags: Path traversal - [Repair App local code execution with arbitrary privileges](https://agentprime.io/advisories/CVE-2023-41970.md) `CVE-2023-41970` · CVE record: Zscaler Client Connector · CVSS 6.0 Medium · Not analysed yet · Published 2 May 2024 · Tags: CWE-354 - [Out-of-bounds write to heap in pacparser](https://agentprime.io/advisories/CVE-2023-28798.md) `CVE-2023-28798` · CVE record: Zscaler Client Connector · CVSS 6.5 Medium · Not analysed yet · Published 2 May 2024 · Tags: Memory corruption - [Insecure MacOS code sign check fallback](https://agentprime.io/advisories/CVE-2024-23480.md) `CVE-2024-23480` · CVE record: Zscaler Client Connector · CVSS 7.5 High · Not analysed yet · Published 1 May 2024 · Tags: Weak cryptography or TLS - [Anti-tampering can be disabled with uninstall password enforced](https://agentprime.io/advisories/CVE-2024-23457.md) `CVE-2024-23457` · CVE record: Zscaler Client Connector · CVSS 7.8 High · Not analysed yet · Published 1 May 2024 · Tags: Privilege escalation - [Anti-Tampering bypass via Repair App functionality](https://agentprime.io/advisories/CVE-2024-23463.md) `CVE-2024-23463` · CVE record: Zscaler Client Connector · CVSS 8.8 High · Not analysed yet · Published 30 Apr 2024 · Tags: Race condition - [ZScalerService Local Privilege Escalation](https://agentprime.io/advisories/CVE-2024-23482.md) `CVE-2024-23482` · CVE record: Zscaler Client Connector · CVSS 7.0 High · Not analysed yet · Published 26 Mar 2024 · Tags: CWE-20 - [Lack of input santization on Zscaler Client Connector enables arbitrary code execution](https://agentprime.io/advisories/CVE-2023-41973.md) `CVE-2023-41973` · CVE record: Zscaler Client Connector · CVSS 7.3 High · Not analysed yet · Published 26 Mar 2024 · Tags: Path traversal - [Revert password check incorrect type validation](https://agentprime.io/advisories/CVE-2023-41972.md) `CVE-2023-41972` · CVE record: Zscaler Client Connector · CVSS 7.3 High · Not analysed yet · Published 26 Mar 2024 · Tags: CWE-280 - [ZSATrayManager Arbitrary File Deletion](https://agentprime.io/advisories/CVE-2023-41969.md) `CVE-2023-41969` · CVE record: Zscaler Client Connector · CVSS 7.3 High · Not analysed yet · Published 26 Mar 2024 · Tags: CWE-61 - [Disable Zscaler using machine tunnel restart](https://agentprime.io/advisories/CVE-2023-28802.md) `CVE-2023-28802` · CVE record: Zscaler Client Connector · CVSS 4.9 Medium · Not analysed yet · Published 21 Nov 2023 · Tags: CWE-354 - [PAC Files Exposed to Internet Websites](https://agentprime.io/advisories/CVE-2023-28794.md) `CVE-2023-28794` · CVE record: Zscaler Client Connector · CVSS 4.3 Medium · Not analysed yet · Published 6 Nov 2023 · Tags: CWE-346 - [ZCC on Linux privilege escalation](https://agentprime.io/advisories/CVE-2023-28805.md) `CVE-2023-28805` · CVE record: Zscaler Client Connector · CVSS 6.7 Medium · Not analysed yet · Published 23 Oct 2023 · Tags: Command injection - [Linux ZCC allows unsigned updates, allowing elevated Code Execution](https://agentprime.io/advisories/CVE-2023-28804.md) `CVE-2023-28804` · CVE record: Zscaler Client Connector · CVSS 8.2 High · Not analysed yet · Published 23 Oct 2023 · Tags: Weak cryptography or TLS - [Traffic being bypassed by ZCC by configuring synthetic IP range as local network](https://agentprime.io/advisories/CVE-2023-28803.md) `CVE-2023-28803` · CVE record: Zscaler Client Connector · CVSS 5.9 Medium · Not analysed yet · Published 23 Oct 2023 · Tags: Authentication bypass - [LPE using arbitrary file delete with Symlinks](https://agentprime.io/advisories/CVE-2023-28797.md) `CVE-2023-28797` · CVE record: Zscaler Client Connector · CVSS 6.3 Medium · Not analysed yet · Published 23 Oct 2023 · Tags: Path traversal - [IPC Bypass Through PLT Section in ELF](https://agentprime.io/advisories/CVE-2023-28796.md) `CVE-2023-28796` · CVE record: Zscaler Client Connector · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2023 · Tags: Code injection - [Client IPC validation bypass](https://agentprime.io/advisories/CVE-2023-28795.md) `CVE-2023-28795` · CVE record: Zscaler Client Connector · CVSS 7.8 High · Not analysed yet · Published 23 Oct 2023 · Tags: CWE-346 - [Heap Based Buffer Overflow in Library](https://agentprime.io/advisories/CVE-2023-28793.md) `CVE-2023-28793` · CVE record: Zscaler Client Connector · CVSS 7.8 High · Not analysed yet · Published 23 Oct 2023 · Tags: Code injection - [Privilege Escalation for ZCC macOS via PATH Variable](https://agentprime.io/advisories/CVE-2021-26738.md) `CVE-2021-26738` · CVE record: Zscaler Client Connector · CVSS 7.8 High · Not analysed yet · Published 23 Oct 2023 · Tags: CWE-426 - [Privilege Escalation Using PID Reuse in ZCC macOS](https://agentprime.io/advisories/CVE-2021-26737.md) `CVE-2021-26737` · CVE record: Zscaler Client Connector · CVSS 5.5 Medium · Not analysed yet · Published 23 Oct 2023 · Tags: CWE-346 - [ZApp Installer Privilege Escalation Vulnerabilities](https://agentprime.io/advisories/CVE-2021-26736.md) `CVE-2021-26736` · CVE record: Zscaler Client Connector · CVSS 6.7 Medium · Not analysed yet · Published 23 Oct 2023 · Tags: CWE-20 - [Untrusted Search Path While Executing REG DELETE by Uninstaller](https://agentprime.io/advisories/CVE-2021-26735.md) `CVE-2021-26735` · CVE record: Zscaler Client Connector · CVSS 6.7 Medium · Not analysed yet · Published 23 Oct 2023 · Tags: CWE-346 - [Junction Delete leading to elevation of privilege](https://agentprime.io/advisories/CVE-2021-26734.md) `CVE-2021-26734` · CVE record: Zscaler Client Connector · CVSS 4.4 Medium · Not analysed yet · Published 23 Oct 2023 · Tags: Privilege escalation - [Output encoding missing in redrurl parameter](https://agentprime.io/advisories/CVE-2023-28800.md) `CVE-2023-28800` · CVE record: Zscaler Client Connector · CVSS 8.1 High · Not analysed yet · Published 22 Jun 2023 · Tags: Cross-site scripting (XSS) - [A URL parameter during login flow was vulnerable to injection.](https://agentprime.io/advisories/CVE-2023-28799.md) `CVE-2023-28799` · CVE record: Zscaler Client Connector · CVSS 8.2 High · Not analysed yet · Published 22 Jun 2023 · Tags: CWE-1287 ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .