ZS
Vendor
Zscaler
62
CVEs
0
On KEV
0
New 30D
Products
CC9.8
Client Connector
Zscaler
50 CVEs0 on KEV0 new
ZI9.8
Zscaler Internet Access Admin Portal
Zscaler
3 CVEs0 on KEV0 new
ZA2.7
ZIA Admin UI
Zscaler
2 CVEs0 on KEV0 new
ZC5.3
Zscaler Client Connector
Zscaler
2 CVEs0 on KEV0 new
AS9.6
Authentication Server
Zscaler
1 CVEs0 on KEV0 new
SI7.5
Secure Internet And Saas Access
Zscaler
1 CVEs0 on KEV0 new
ZI7.5
ZIA
Zscaler
1 CVEs0 on KEV0 new
ZS4.6
zscaler-mcp-server
Zscaler
1 CVEs0 on KEV0 new
ZP5.5
Zscaler Proxy
Zscaler
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-59563 | ZS zscaler-mcp-server Zscaler | 4.6 | Sep 28 | HMAC Confirmation Token Unbinding in zscaler-mcp-server |
| CVE-2026-59570 | CC Client Connector Zscaler | 7.5 | Sep 14 | Android ZCC denial of service |
| CVE-2026-59569 | CC Client Connector Zscaler | 8.1 | Sep 14 | Android ZCC VPN API method privilege escalation |
| CVE-2026-25687 | CC Client Connector Zscaler | 8.1 | Sep 14 | ZCC race condition in ZPA tunnel handler |
| CVE-2026-59568 | CC Client Connector Zscaler | 9.1 | Aug 24 | Remote Code Execution |
| CVE-2026-59567 | CC Client Connector Zscaler | 8.8 | Aug 24 | Local privilege escalation |
| CVE-2026-59566 | CC Client Connector Zscaler | 8.4 | Aug 24 | Local denial-of-service |
| CVE-2026-59565 | CC Client Connector Zscaler | 8.8 | Aug 24 | Local and kernel denial-of-service |
| CVE-2026-59564 | CC Client Connector Zscaler | 9.1 | Aug 24 | Authentication bypass between ZCC and client connector portal |
| CVE-2026-22569 | ZC Zscaler Client Connector Zscaler | 5.3 | Mar 31 | Incorrect startup configuration in ZCC |
| CVE-2026-22567 | ZA ZIA Admin UI Zscaler | 2.7 | Feb 23 | ZIA Admin UI Input Validation Bug |
| CVE-2026-22568 | ZA ZIA Admin UI Zscaler | 2.7 | Feb 23 | Unauthorized information retrieval in ZIA Admin UI |
| CVE-2025-54983 | ZC Zscaler Client Connector Zscaler | 5.2 | Nov 12 | Health check port on ZCC allows tunnel bypass |
| CVE-2025-54982 | AS Authentication Server Zscaler | 9.6 | Aug 5 | SAML 2.0 Public Key Validation Issue |
| CVE-2024-31127 | CC Client Connector Zscaler | 7.3 | Jun 4 | MacOS Zscaler Client Connector Local Privilege Escalation |
| CVE-2023-28806 | CC Client Connector Zscaler | 6.5 | Aug 6 | Signature validation error in DLL allows disabling anti-tampering protection |
| CVE-2024-23483 | CC Client Connector Zscaler | 9.8 | Aug 6 | Local Privilege Escalation via lack of input validation |
| CVE-2024-23460 | CC Client Connector Zscaler | 7.8 | Aug 6 | Incorrect signature validation of package |
| CVE-2024-23464 | CC Client Connector Zscaler | 4.9 | Aug 6 | Zscaler bypass with administrative privileges on Windows |
| CVE-2024-23458 | CC Client Connector Zscaler | 7.8 | Aug 6 | Local Privilege Escalation on Zscaler Client Connector on Windows |
| CVE-2024-23456 | CC Client Connector Zscaler | 7.5 | Aug 6 | Signature validation issue leads to Anti-Tampering bypass |
| CVE-2024-3661 | CC Client Connector Zscaler | 7.6 | May 6 | DHCP routing options can manipulate interface-based VPN traffic |
| CVE-2024-23462 | CC Client Connector Zscaler | 7.5 | May 2 | ZCC Mac validinstaller file integrity check missing |
| CVE-2024-23461 | CC Client Connector Zscaler | 5.5 | May 2 | ZCC macOS Upgrade ZIP Bomb DoS |
| CVE-2024-23459 | CC Client Connector Zscaler | 9.8 | May 2 | Multiple Arbitrary Creates/Overwrites by link following |
| CVE-2023-41971 | CC Client Connector Zscaler | 7.8 | May 2 | Windows ZCC Upgrade DoS And Privilege Escalation Through RPC Control |
| CVE-2023-41970 | CC Client Connector Zscaler | 7.8 | May 2 | Repair App local code execution with arbitrary privileges |
| CVE-2023-28798 | CC Client Connector Zscaler | 9.8 | May 2 | Out-of-bounds write to heap in pacparser |
| CVE-2024-23480 | CC Client Connector Zscaler | 9.8 | May 1 | Insecure MacOS code sign check fallback |
| CVE-2024-23457 | CC Client Connector Zscaler | 7.8 | May 1 | Anti-tampering can be disabled with uninstall password enforced |
| CVE-2024-23463 | CC Client Connector Zscaler | 8.1 | Apr 30 | Anti-Tampering bypass via Repair App functionality |
| CVE-2024-23482 | CC Client Connector Zscaler | 7.8 | Mar 26 | ZScalerService Local Privilege Escalation |
| CVE-2023-41973 | CC Client Connector Zscaler | 7.8 | Mar 26 | Lack of input santization on Zscaler Client Connector enables arbitrary code execution |
| CVE-2023-41972 | CC Client Connector Zscaler | 7.8 | Mar 26 | Revert password check incorrect type validation |
| CVE-2023-41969 | CC Client Connector Zscaler | 7.1 | Mar 26 | ZSATrayManager Arbitrary File Deletion |
| CVE-2023-28807 | ZI ZIA Zscaler | 7.5 | Jan 31 | Bypass of ZIA domain fronting detection module through evasion technique |
| CVE-2023-28802 | CC Client Connector Zscaler | 5.4 | Nov 21 | Disable Zscaler using machine tunnel restart |
| CVE-2023-28794 | CC Client Connector Zscaler | 6.5 | Nov 6 | PAC Files Exposed to Internet Websites |
| CVE-2023-28805 | CC Client Connector Zscaler | 9.8 | Oct 23 | An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation |
| CVE-2023-28804 | CC Client Connector Zscaler | 5.3 | Oct 23 | An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Client Connector: before… |
| CVE-2023-28803 | CC Client Connector Zscaler | 6.5 | Oct 23 | An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypass |
| CVE-2023-28797 | CC Client Connector Zscaler | 7.3 | Oct 23 | Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk |
| CVE-2023-28796 | CC Client Connector Zscaler | 7.8 | Oct 23 | Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection |
| CVE-2023-28795 | CC Client Connector Zscaler | 7.8 | Oct 23 | Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process |
| CVE-2023-28793 | CC Client Connector Zscaler | 7.8 | Oct 23 | Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection |
| CVE-2021-26738 | CC Client Connector Zscaler | 7.8 | Oct 23 | Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable |
| CVE-2021-26737 | CC Client Connector Zscaler | 4.7 | Oct 23 | The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients |
| CVE-2021-26736 | CC Client Connector Zscaler | 7.8 | Oct 23 | Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged path |
| CVE-2021-26735 | CC Client Connector Zscaler | 7.8 | Oct 23 | The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability |
| CVE-2021-26734 | CC Client Connector Zscaler | 5.5 | Oct 23 | Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation |
| CVE-2023-41717 | ZP Zscaler Proxy Zscaler | 5.5 | Aug 31 | Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local attackers to bypass file download/upload restrictions |
| CVE-2023-28801 | ZI Zscaler Internet Access Admin Portal Zscaler | 9.8 | Aug 31 | An Improper Verification of Cryptographic Signature in the SAML authentication of the Zscaler Admin UI allows a Privilege Escalation.This issue affects Admin UI: from 6.2 before… |
| CVE-2023-28800 | CC Client Connector Zscaler | 6.1 | Jun 22 | When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login |
| CVE-2023-28799 | CC Client Connector Zscaler | 6.1 | Jun 22 | A URL parameter during login flow was vulnerable to injection |
| CVE-2020-11634 | CC Client Connector Zscaler | 7.8 | Jul 15 | The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL |
| CVE-2020-11632 | CC Client Connector Zscaler | 7.8 | Jul 15 | The Zscaler Client Connector prior to 2.1.2.150 did not quote the search path for services, which allows a local adversary to execute code with system privileges |
| CVE-2020-11633 | CC Client Connector Zscaler | 9.8 | Jul 15 | The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer overflow when connecting to misconfigured TLS servers |
| CVE-2020-11635 | CC Client Connector Zscaler | 7.8 | Feb 16 | The Zscaler Client Connector prior to 3.1.0 did not sufficiently validate RPC clients, which allows a local adversary to execute code with system privileges or perform limited… |