This vulnerability is a race condition (CWE-366) in the ZPA tunnel handler of Zscaler Client Connector versions 4.6 up to but not including 4.6.0.486, 4.7 up to but not including 4.7.0.350, 4.8 up to but not including 4.8.0.267, and 4.9 up to but not including 4.9.0.412. The race condition can cause heap corruption, which may result in denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation can cause the Zscaler Client Connector to crash, resulting in denial of service. Additionally, it may allow an attacker to execute arbitrary code within the context of the ZCC process, potentially compromising the client system's security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch links are provided, users should monitor Zscaler's official advisories for updates and apply any released fixes promptly. Until a patch is available, consider limiting exposure of vulnerable versions and applying any recommended temporary mitigations from the vendor.