Zscaler Client Connector Installer
by Zscaler
CVEs (15)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-11633 | Cri | 0.64 | 9.8 | 0.02 | Jul 15, 2021 | The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer overflow when connecting to misconfigured TLS servers. An adversary would potentially have been able to execute arbitrary code with system privileges. | ||
| CVE-2026-59568 | Cri | 0.59 | 9.1 | 0.01 | Aug 24, 2026 | Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context. | ||
| CVE-2026-59564 | Cri | 0.59 | 9.1 | 0.01 | Aug 24, 2026 | An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal. | ||
| CVE-2026-59567 | Hig | 0.57 | 8.8 | 0.00 | Aug 24, 2026 | Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in a privileged context. | ||
| CVE-2026-59566 | Hig | 0.55 | 8.4 | 0.00 | Aug 24, 2026 | A locally exploitable buffer overflow bug can cause a local denial-of-service attack on affected versions of Zscaler Client Connector on Android and ChromeOS. | ||
| CVE-2026-59569 | Hig | 0.53 | 8.1 | 0.00 | Sep 14, 2026 | An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls. | ||
| CVE-2026-25687 | Hig | 0.53 | 8.1 | 0.00 | Sep 14, 2026 | A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process. | ||
| CVE-2020-11634 | Hig | 0.51 | 7.8 | 0.00 | Jul 15, 2021 | The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL. A local adversary may be able to execute arbitrary code in the SYSTEM context. | ||
| CVE-2020-11632 | Hig | 0.51 | 7.8 | 0.00 | Jul 15, 2021 | The Zscaler Client Connector prior to 2.1.2.150 did not quote the search path for services, which allows a local adversary to execute code with system privileges. | ||
| CVE-2020-11635 | Hig | 0.51 | 7.8 | 0.00 | Feb 16, 2021 | The Zscaler Client Connector prior to 3.1.0 did not sufficiently validate RPC clients, which allows a local adversary to execute code with system privileges or perform limited actions for which they did not have privileges. | ||
| CVE-2026-59570 | Hig | 0.49 | 7.5 | 0.00 | Sep 14, 2026 | On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture. | ||
| CVE-2024-23464 | Hig | 0.47 | 7.2 | 0.00 | Aug 6, 2024 | In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows <4.2.1 | ||
| CVE-2021-26736 | Med | 0.44 | 6.7 | 0.00 | Oct 23, 2023 | Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged path. A local adversary may be able to execute code with SYSTEM privileges. | ||
| CVE-2021-26735 | Med | 0.44 | 6.7 | 0.00 | Oct 23, 2023 | The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversary may be able to execute code with SYSTEM privileges. | ||
| CVE-2025-54983 | Med | 0.34 | 5.2 | 0.00 | Nov 12, 2025 | A health check port on Zscaler Client Connector on Windows, versions 4.6 < 4.6.0.216 and 4.7 < 4.7.0.47, which under specific circumstances was not released after use, allowed traffic to potentially bypass ZCC forwarding controls. |
- risk 0.64cvss 9.8epss 0.02
The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer overflow when connecting to misconfigured TLS servers. An adversary would potentially have been able to execute arbitrary code with system privileges.
- risk 0.59cvss 9.1epss 0.01
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context.
- risk 0.59cvss 9.1epss 0.01
An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal.
- risk 0.57cvss 8.8epss 0.00
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in a privileged context.
- risk 0.55cvss 8.4epss 0.00
A locally exploitable buffer overflow bug can cause a local denial-of-service attack on affected versions of Zscaler Client Connector on Android and ChromeOS.
- risk 0.53cvss 8.1epss 0.00
An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls.
- risk 0.53cvss 8.1epss 0.00
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.
- risk 0.51cvss 7.8epss 0.00
The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL. A local adversary may be able to execute arbitrary code in the SYSTEM context.
- risk 0.51cvss 7.8epss 0.00
The Zscaler Client Connector prior to 2.1.2.150 did not quote the search path for services, which allows a local adversary to execute code with system privileges.
- risk 0.51cvss 7.8epss 0.00
The Zscaler Client Connector prior to 3.1.0 did not sufficiently validate RPC clients, which allows a local adversary to execute code with system privileges or perform limited actions for which they did not have privileges.
- risk 0.49cvss 7.5epss 0.00
On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture.
- risk 0.47cvss 7.2epss 0.00
In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows <4.2.1
- risk 0.44cvss 6.7epss 0.00
Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged path. A local adversary may be able to execute code with SYSTEM privileges.
- risk 0.44cvss 6.7epss 0.00
The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversary may be able to execute code with SYSTEM privileges.
- risk 0.34cvss 5.2epss 0.00
A health check port on Zscaler Client Connector on Windows, versions 4.6 < 4.6.0.216 and 4.7 < 4.7.0.47, which under specific circumstances was not released after use, allowed traffic to potentially bypass ZCC forwarding controls.