Advisories · Technology

Zscaler Client Connector.

Every CVE that names Zscaler Client Connector among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-59570 CVE record

CVSS 7.5 High

Android ZCC denial of service
- Zscaler Client Connector
- CWE-20
Not analysed yet 14 Sept 2026
CVE-2026-59569 CVE record

CVSS 8.1 High

Android ZCC VPN API method privilege escalation
- Zscaler Client Connector
- CWE-20
Not analysed yet 14 Sept 2026
CVE-2026-25687 CVE record

CVSS 8.1 High

ZCC race condition in ZPA tunnel handler
- Zscaler Client Connector
- CWE-366
Not analysed yet 14 Sept 2026
CVE-2026-59568 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Remote Code Execution
- Zscaler Client Connector
- CWE-20
Not analysed yet 24 Aug 2026
CVE-2026-59567 CVE record

CVSS 8.8 High

Local privilege escalation
- Zscaler Client Connector
- CWE-280
Not analysed yet 24 Aug 2026
CVE-2026-59566 CVE record

CVSS 8.4 High

Local denial-of-service
- Zscaler Client Connector
- CWE-229
Not analysed yet 24 Aug 2026
CVE-2026-59565 CVE record

CVSS 8.8 High

Local and kernel denial-of-service
- Zscaler Client Connector
- CWE-229
Not analysed yet 24 Aug 2026
CVE-2026-59564 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Authentication bypass between ZCC and client connector portal
- Zscaler Client Connector
- Authentication bypass
Not analysed yet 24 Aug 2026
CVE-2026-22569 CVE record

CVSS 5.4 Medium

Incorrect startup configuration in ZCC
- Zscaler Client Connector
- CWE-1289
Not analysed yet 31 Mar 2026
CVE-2025-54983 CVE record

CVSS 5.2 Medium

Health check port on ZCC allows tunnel bypass
- Zscaler Client Connector
- Denial of service
Not analysed yet 12 Nov 2025
CVE-2024-31127 CVE record

CVSS 7.3 High

MacOS Zscaler Client Connector Local Privilege Escalation
- Zscaler Client Connector
- CWE-346
Not analysed yet 4 Jun 2025
CVE-2023-28806 CVE record

CVSS 5.7 Medium

Signature validation error in DLL allows disabling anti-tampering protection
- Zscaler Client Connector
- Weak cryptography or TLS
Not analysed yet 6 Aug 2024
CVE-2024-23483 CVE record

CVSS 7.0 High

Local Privilege Escalation via lack of input validation
- Zscaler Client Connector
- CWE-20
Not analysed yet 6 Aug 2024
CVE-2024-23460 CVE record

CVSS 6.4 Medium

Incorrect signature validation of package
- Zscaler Client Connector
- Weak cryptography or TLS
Not analysed yet 6 Aug 2024
CVE-2024-23464 CVE record

CVSS 7.2 High

Zscaler bypass with administrative privileges on Windows
- Zscaler Client Connector
- CWE-281
Not analysed yet 6 Aug 2024
CVE-2024-23458 CVE record

CVSS 7.3 High

Local Privilege Escalation on Zscaler Client Connector on Windows
- Zscaler Client Connector
- CWE-346
Not analysed yet 6 Aug 2024
CVE-2024-23456 CVE record

CVSS 7.8 High

Signature validation issue leads to Anti-Tampering bypass
- Zscaler Client Connector
- Weak cryptography or TLS
Not analysed yet 6 Aug 2024
CVE-2024-23462 CVE record

CVSS 3.3 Low

ZCC Mac validinstaller file integrity check missing
- Zscaler Client Connector
- CWE-354
Not analysed yet 2 May 2024
CVE-2024-23461 CVE record

CVSS 4.2 Medium

ZCC macOS Upgrade ZIP Bomb DoS
- Zscaler Client Connector
- CWE-354
Not analysed yet 2 May 2024
CVE-2024-23459 CVE record

CVSS 7.1 High

Multiple Arbitrary Creates/Overwrites by link following
- Zscaler Client Connector
- Path traversal
Not analysed yet 2 May 2024
CVE-2023-41971 CVE record

CVSS 5.3 Medium

Windows ZCC Upgrade DoS And Privilege Escalation Through RPC Control
- Zscaler Client Connector
- Path traversal
Not analysed yet 2 May 2024
CVE-2023-41970 CVE record

CVSS 6.0 Medium

Repair App local code execution with arbitrary privileges
- Zscaler Client Connector
- CWE-354
Not analysed yet 2 May 2024
CVE-2023-28798 CVE record

CVSS 6.5 Medium

Out-of-bounds write to heap in pacparser
- Zscaler Client Connector
- Memory corruption
Not analysed yet 2 May 2024
CVE-2024-23480 CVE record

CVSS 7.5 High

Insecure MacOS code sign check fallback
- Zscaler Client Connector
- Weak cryptography or TLS
Not analysed yet 1 May 2024
CVE-2024-23457 CVE record

CVSS 7.8 High

Anti-tampering can be disabled with uninstall password enforced
- Zscaler Client Connector
- Privilege escalation
Not analysed yet 1 May 2024
CVE-2024-23463 CVE record

CVSS 8.8 High

Anti-Tampering bypass via Repair App functionality
- Zscaler Client Connector
- Race condition
Not analysed yet 30 Apr 2024
CVE-2024-23482 CVE record

CVSS 7.0 High

ZScalerService Local Privilege Escalation
- Zscaler Client Connector
- CWE-20
Not analysed yet 26 Mar 2024
CVE-2023-41973 CVE record

CVSS 7.3 High

Lack of input santization on Zscaler Client Connector enables arbitrary code execution
- Zscaler Client Connector
- Path traversal
Not analysed yet 26 Mar 2024
CVE-2023-41972 CVE record

CVSS 7.3 High

Revert password check incorrect type validation
- Zscaler Client Connector
- CWE-280
Not analysed yet 26 Mar 2024
CVE-2023-41969 CVE record

CVSS 7.3 High

ZSATrayManager Arbitrary File Deletion
- Zscaler Client Connector
- CWE-61
Not analysed yet 26 Mar 2024
CVE-2023-28802 CVE record

CVSS 4.9 Medium

Disable Zscaler using machine tunnel restart
- Zscaler Client Connector
- CWE-354
Not analysed yet 21 Nov 2023
CVE-2023-28794 CVE record

CVSS 4.3 Medium

PAC Files Exposed to Internet Websites
- Zscaler Client Connector
- CWE-346
Not analysed yet 6 Nov 2023
CVE-2023-28805 CVE record

CVSS 6.7 Medium

ZCC on Linux privilege escalation
- Zscaler Client Connector
- Command injection
Not analysed yet 23 Oct 2023
CVE-2023-28804 CVE record

CVSS 8.2 High

Linux ZCC allows unsigned updates, allowing elevated Code Execution
- Zscaler Client Connector
- Weak cryptography or TLS
Not analysed yet 23 Oct 2023
CVE-2023-28803 CVE record

CVSS 5.9 Medium

Traffic being bypassed by ZCC by configuring synthetic IP range as local network
- Zscaler Client Connector
- Authentication bypass
Not analysed yet 23 Oct 2023
CVE-2023-28797 CVE record

CVSS 6.3 Medium

LPE using arbitrary file delete with Symlinks
- Zscaler Client Connector
- Path traversal
Not analysed yet 23 Oct 2023
CVE-2023-28796 CVE record

CVSS 7.1 High

IPC Bypass Through PLT Section in ELF
- Zscaler Client Connector
- Code injection
Not analysed yet 23 Oct 2023
CVE-2023-28795 CVE record

CVSS 7.8 High

Client IPC validation bypass
- Zscaler Client Connector
- CWE-346
Not analysed yet 23 Oct 2023
CVE-2023-28793 CVE record

CVSS 7.8 High

Heap Based Buffer Overflow in Library
- Zscaler Client Connector
- Code injection
Not analysed yet 23 Oct 2023
CVE-2021-26738 CVE record

CVSS 7.8 High

Privilege Escalation for ZCC macOS via PATH Variable
- Zscaler Client Connector
- CWE-426
Not analysed yet 23 Oct 2023
CVE-2021-26737 CVE record

CVSS 5.5 Medium

Privilege Escalation Using PID Reuse in ZCC macOS
- Zscaler Client Connector
- CWE-346
Not analysed yet 23 Oct 2023
CVE-2021-26736 CVE record

CVSS 6.7 Medium

ZApp Installer Privilege Escalation Vulnerabilities
- Zscaler Client Connector
- CWE-20
Not analysed yet 23 Oct 2023
CVE-2021-26735 CVE record

CVSS 6.7 Medium

Untrusted Search Path While Executing REG DELETE by Uninstaller
- Zscaler Client Connector
- CWE-346
Not analysed yet 23 Oct 2023
CVE-2021-26734 CVE record

CVSS 4.4 Medium

Junction Delete leading to elevation of privilege
- Zscaler Client Connector
- Privilege escalation
Not analysed yet 23 Oct 2023
CVE-2023-28800 CVE record

CVSS 8.1 High

Output encoding missing in redrurl parameter
- Zscaler Client Connector
- Cross-site scripting (XSS)
Not analysed yet 22 Jun 2023
CVE-2023-28799 CVE record

CVSS 8.2 High

A URL parameter during login flow was vulnerable to injection.
- Zscaler Client Connector
- CWE-1287
Not analysed yet 22 Jun 2023