# cve.now: Zscaler

The newest entries naming Zscaler as an affected vendor (up to 200), of 53 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-59563](https://cve.now/CVE-2026-59563.md): HMAC Confirmation Token Unbinding in zscaler-mcp-server (CVSS 4.6)
- [CVE-2026-25684](https://cve.now/CVE-2026-25684.md): File Type Control rule bypass (CVSS 4.4)
- [CVE-2026-59570](https://cve.now/CVE-2026-59570.md): Android ZCC denial of service (CVSS 7.5)
- [CVE-2026-59569](https://cve.now/CVE-2026-59569.md): Android ZCC VPN API method privilege escalation (CVSS 8.1)
- [CVE-2026-25687](https://cve.now/CVE-2026-25687.md): ZCC race condition in ZPA tunnel handler (CVSS 8.1)
- [CVE-2026-59568](https://cve.now/CVE-2026-59568.md): Remote Code Execution (CVSS 9.1)
- [CVE-2026-59567](https://cve.now/CVE-2026-59567.md): Local privilege escalation (CVSS 8.8)
- [CVE-2026-59566](https://cve.now/CVE-2026-59566.md): Local denial-of-service (CVSS 8.4)
- [CVE-2026-59565](https://cve.now/CVE-2026-59565.md): Local and kernel denial-of-service (CVSS 8.8)
- [CVE-2026-59564](https://cve.now/CVE-2026-59564.md): Authentication bypass between ZCC and client connector portal (CVSS 9.1)
- [CVE-2026-22569](https://cve.now/CVE-2026-22569.md): Incorrect startup configuration in ZCC (CVSS 5.4)
- [CVE-2026-22567](https://cve.now/CVE-2026-22567.md): ZIA Admin UI Input Validation Bug (CVSS 7.6)
- [CVE-2026-22568](https://cve.now/CVE-2026-22568.md): Unauthorized information retrieval in ZIA Admin UI (CVSS 5.5)
- [CVE-2025-54983](https://cve.now/CVE-2025-54983.md): Health check port on ZCC allows tunnel bypass (CVSS 5.2)
- [CVE-2025-54982](https://cve.now/CVE-2025-54982.md): SAML 2.0 Public Key Validation Issue (CVSS 9.6)
- [CVE-2024-31127](https://cve.now/CVE-2024-31127.md): MacOS Zscaler Client Connector Local Privilege Escalation (CVSS 7.3)
- [CVE-2023-28806](https://cve.now/CVE-2023-28806.md): Signature validation error in DLL allows disabling anti-tampering protection (CVSS 5.7)
- [CVE-2024-23483](https://cve.now/CVE-2024-23483.md): Local Privilege Escalation via lack of input validation (CVSS 7.0)
- [CVE-2024-23460](https://cve.now/CVE-2024-23460.md): Incorrect signature validation of package (CVSS 6.4)
- [CVE-2024-23464](https://cve.now/CVE-2024-23464.md): Zscaler bypass with administrative privileges on Windows (CVSS 7.2)
- [CVE-2024-23458](https://cve.now/CVE-2024-23458.md): Local Privilege Escalation on Zscaler Client Connector on Windows (CVSS 7.3)
- [CVE-2024-23456](https://cve.now/CVE-2024-23456.md): Signature validation issue leads to Anti-Tampering bypass (CVSS 7.8)
- [CVE-2024-23462](https://cve.now/CVE-2024-23462.md): ZCC Mac validinstaller file integrity check missing (CVSS 3.3)
- [CVE-2024-23461](https://cve.now/CVE-2024-23461.md): ZCC macOS Upgrade ZIP Bomb DoS (CVSS 4.2)
- [CVE-2024-23459](https://cve.now/CVE-2024-23459.md): Multiple Arbitrary Creates/Overwrites by link following (CVSS 7.1)
- [CVE-2023-41971](https://cve.now/CVE-2023-41971.md): Windows ZCC Upgrade DoS And Privilege Escalation Through RPC Control (CVSS 5.3)
- [CVE-2023-41970](https://cve.now/CVE-2023-41970.md): Repair App local code execution with arbitrary privileges (CVSS 6.0)
- [CVE-2023-28798](https://cve.now/CVE-2023-28798.md): Out-of-bounds write to heap in pacparser (CVSS 6.5)
- [CVE-2024-23480](https://cve.now/CVE-2024-23480.md): Insecure MacOS code sign check fallback (CVSS 7.5)
- [CVE-2024-23457](https://cve.now/CVE-2024-23457.md): Anti-tampering can be disabled with uninstall password enforced (CVSS 7.8)
- [CVE-2024-23463](https://cve.now/CVE-2024-23463.md): Anti-Tampering bypass via Repair App functionality (CVSS 8.8)
- [CVE-2024-23482](https://cve.now/CVE-2024-23482.md): ZScalerService Local Privilege Escalation (CVSS 7.0)
- [CVE-2023-41973](https://cve.now/CVE-2023-41973.md): Lack of input santization on Zscaler Client Connector enables arbitrary code execution (CVSS 7.3)
- [CVE-2023-41972](https://cve.now/CVE-2023-41972.md): Revert password check incorrect type validation (CVSS 7.3)
- [CVE-2023-41969](https://cve.now/CVE-2023-41969.md): ZSATrayManager Arbitrary File Deletion (CVSS 7.3)
- [CVE-2023-28807](https://cve.now/CVE-2023-28807.md): Bypass of ZIA domain fronting detection module through evasion technique (CVSS 5.1)
- [CVE-2023-28802](https://cve.now/CVE-2023-28802.md): Disable Zscaler using machine tunnel restart (CVSS 4.9)
- [CVE-2023-28794](https://cve.now/CVE-2023-28794.md): PAC Files Exposed to Internet Websites (CVSS 4.3)
- [CVE-2023-28805](https://cve.now/CVE-2023-28805.md): ZCC on Linux privilege escalation (CVSS 6.7)
- [CVE-2023-28804](https://cve.now/CVE-2023-28804.md): Linux ZCC allows unsigned updates, allowing elevated Code Execution (CVSS 8.2)
- [CVE-2023-28803](https://cve.now/CVE-2023-28803.md): Traffic being bypassed by ZCC by configuring synthetic IP range as local network (CVSS 5.9)
- [CVE-2023-28797](https://cve.now/CVE-2023-28797.md): LPE using arbitrary file delete with Symlinks (CVSS 6.3)
- [CVE-2023-28796](https://cve.now/CVE-2023-28796.md): IPC Bypass Through PLT Section in ELF (CVSS 7.1)
- [CVE-2023-28795](https://cve.now/CVE-2023-28795.md): Client IPC validation bypass (CVSS 7.8)
- [CVE-2023-28793](https://cve.now/CVE-2023-28793.md): Heap Based Buffer Overflow in Library (CVSS 7.8)
- [CVE-2021-26738](https://cve.now/CVE-2021-26738.md): Privilege Escalation for ZCC macOS via PATH Variable (CVSS 7.8)
- [CVE-2021-26737](https://cve.now/CVE-2021-26737.md): Privilege Escalation Using PID Reuse in ZCC macOS (CVSS 5.5)
- [CVE-2021-26736](https://cve.now/CVE-2021-26736.md): ZApp Installer Privilege Escalation Vulnerabilities (CVSS 6.7)
- [CVE-2021-26735](https://cve.now/CVE-2021-26735.md): Untrusted Search Path While Executing REG DELETE by Uninstaller (CVSS 6.7)
- [CVE-2021-26734](https://cve.now/CVE-2021-26734.md): Junction Delete leading to elevation of privilege (CVSS 4.4)
- [CVE-2023-28801](https://cve.now/CVE-2023-28801.md): Improper SAML signature verification (CVSS 9.6)
- [CVE-2023-28800](https://cve.now/CVE-2023-28800.md): Output encoding missing in redrurl parameter (CVSS 8.1)
- [CVE-2023-28799](https://cve.now/CVE-2023-28799.md): A URL parameter during login flow was vulnerable to injection. (CVSS 8.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/zscaler
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.