Zscaler Client Connector vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Zscaler Client Connector: 10 record(s), with affected versions and fixes.cpe:2.3:a:zscaler:client_connector
CVE-2026-59570
High · 7.5
CWE-20 Sep 14, 2026
Android ZCC denial of service
On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture.
CVE-2026-59569
High · 8.1
CWE-20 Sep 14, 2026
Android ZCC VPN API method privilege escalation
An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls.
CVE-2026-25687
High · 8.1
CWE-366 Sep 14, 2026
ZCC race condition in ZPA tunnel handler
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.
CVE-2026-59568
Critical · 9.1
CWE-20 Aug 24, 2026
Remote Code Execution
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context.
CVE-2026-59567
High · 8.8
CWE-280 Aug 24, 2026
Local privilege escalation
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in a privileged context.
CVE-2026-59566
High · 8.4
CWE-229 Aug 24, 2026
Local denial-of-service
A locally exploitable buffer overflow bug can cause a local denial-of-service attack on affected versions of Zscaler Client Connector on Android and ChromeOS.
CVE-2026-59565
High · 8.8
CWE-229 Aug 24, 2026
Local and kernel denial-of-service
A remotely exploitable buffer overflow bug can cause a local and kernel denial-of-service attack on affected versions of Zscaler Client Connector on Windows.
CVE-2026-59564
Critical · 9.1
CWE-304 Aug 24, 2026
Authentication bypass between ZCC and client connector portal
An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal.
CVE-2026-22569
Medium · 5.3
CWE-1289 Mar 31, 2026
Incorrect startup configuration in ZCC
An incorrect startup configuration of affected versions of Zscaler Client Connector on Windows may cause a limited amount of traffic from being inspected under rare circumstances.
CVE-2025-54983
Medium · 5.2
CWE-772 Nov 12, 2025
Health check port on ZCC allows tunnel bypass
A health check port on Zscaler Client Connector on Windows, versions 4.6 < 4.6.0.216 and 4.7 < 4.7.0.47, which under specific circumstances was not released after use, allowed traffic to potentially bypass ZCC forwarding controls.