Zscaler vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Zscaler products: 9 record(s), with severity, exploitation and fixes.

Client Connector 7 Zscaler Internet Access Admin Portal 2 ZIA Admin UI 2

Exploited only (KEV) →

CVE-2026-59568 Critical · 9.1 CWE-20 Aug 24, 2026

Remote Code Execution

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context.

CVE-2026-59567 High · 8.8 CWE-280 Aug 24, 2026

Local privilege escalation

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in a privileged context.

CVE-2026-59566 High · 8.4 CWE-229 Aug 24, 2026

Local denial-of-service

A locally exploitable buffer overflow bug can cause a local denial-of-service attack on affected versions of Zscaler Client Connector on Android and ChromeOS.

CVE-2026-59565 High · 8.8 CWE-229 Aug 24, 2026

Local and kernel denial-of-service

A remotely exploitable buffer overflow bug can cause a local and kernel denial-of-service attack on affected versions of Zscaler Client Connector on Windows.

CVE-2026-59564 Critical · 9.1 CWE-304 Aug 24, 2026

Authentication bypass between ZCC and client connector portal

An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal.

CVE-2026-22569 Medium · 5.3 CWE-1289 Mar 31, 2026

Incorrect startup configuration in ZCC

An incorrect startup configuration of affected versions of Zscaler Client Connector on Windows may cause a limited amount of traffic from being inspected under rare circumstances.

CVE-2026-22568 Low · 2.7 CWE-20 Feb 23, 2026

Unauthorized information retrieval in ZIA Admin UI

Improper neutralization of special elements in user-supplied input within the ZIA Admin UI could allow an authenticated administrator to access or retrieve unauthorized internal information in rare conditions.

CVE-2026-22567 Low · 2.7 CWE-20 Feb 23, 2026

ZIA Admin UI Input Validation Bug

Improper validation of user-supplied input in the ZIA Admin UI could allow an authenticated administrator to initiate backend functions through specific input fields in limited scenarios.

CVE-2025-54983 Medium · 5.2 CWE-772 Nov 12, 2025

Health check port on ZCC allows tunnel bypass

A health check port on Zscaler Client Connector on Windows, versions 4.6 < 4.6.0.216 and 4.7 < 4.7.0.47, which under specific circumstances was not released after use, allowed traffic to potentially bypass ZCC forwarding controls.