Zscaler vulnerabilities
53 CVEs and advisories name Zscaler as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-59563HMAC Confirmation Token Unbinding in zscaler-mcp-server
- CVE-2026-25684File Type Control rule bypass
- CVE-2026-59570Android ZCC denial of service
- CVE-2026-59569Android ZCC VPN API method privilege escalation
- CVE-2026-25687ZCC race condition in ZPA tunnel handler
- CVE-2026-59568Remote Code Execution
- CVE-2026-59567Local privilege escalation
- CVE-2026-59566Local denial-of-service
- CVE-2026-59565Local and kernel denial-of-service
- CVE-2026-59564Authentication bypass between ZCC and client connector portal
- CVE-2026-22569Incorrect startup configuration in ZCC
- CVE-2026-22567ZIA Admin UI Input Validation Bug
- CVE-2026-22568Unauthorized information retrieval in ZIA Admin UI
- CVE-2025-54983Health check port on ZCC allows tunnel bypass
- CVE-2025-54982SAML 2.0 Public Key Validation Issue
- CVE-2024-31127MacOS Zscaler Client Connector Local Privilege Escalation
- CVE-2023-28806Signature validation error in DLL allows disabling anti-tampering protection
- CVE-2024-23483Local Privilege Escalation via lack of input validation
- CVE-2024-23460Incorrect signature validation of package
- CVE-2024-23464Zscaler bypass with administrative privileges on Windows
- CVE-2024-23458Local Privilege Escalation on Zscaler Client Connector on Windows
- CVE-2024-23456Signature validation issue leads to Anti-Tampering bypass
- CVE-2024-23462ZCC Mac validinstaller file integrity check missing
- CVE-2024-23461ZCC macOS Upgrade ZIP Bomb DoS
- CVE-2024-23459Multiple Arbitrary Creates/Overwrites by link following
- CVE-2023-41971Windows ZCC Upgrade DoS And Privilege Escalation Through RPC Control
- CVE-2023-41970Repair App local code execution with arbitrary privileges
- CVE-2023-28798Out-of-bounds write to heap in pacparser
- CVE-2024-23480Insecure MacOS code sign check fallback
- CVE-2024-23457Anti-tampering can be disabled with uninstall password enforced