Threat database

Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2.

A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances.

On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture.

An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls.

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.

CVE-2026-59568 is a critical vulnerability in Zscaler Client Connector involving improper input validation. It allows an unauthenticated, unprivileged attacker to execute arbitrary code remotely within the context of the Zscaler Client Connector. The vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality and integrity. No affected versions or patch information are provided, and no known exploits are reported in the wild.

CVE-2026-59567 is a high-severity vulnerability in Zscaler Client Connector involving improper handling of insufficient permissions or privileges. It allows local privilege escalation, enabling an unprivileged user to execute arbitrary code with elevated privileges. The vulnerability is identified as CWE-280 and has a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability. No specific affected versions or patch information are provided. There are no known exploits in the wild at this time.

CVE-2026-59566 is a high-severity vulnerability in Zscaler Client Connector for Android and ChromeOS. It involves improper handling of values (CWE-229) leading to a locally exploitable buffer overflow. This flaw can cause a local denial-of-service (DoS) condition on affected devices. No specific affected versions or patches are currently documented. There is no indication of active exploitation in the wild.

CVE-2026-59565 is a high-severity vulnerability in Zscaler Client Connector for Windows involving improper handling of values that leads to a remotely exploitable buffer overflow. This flaw can cause denial-of-service conditions at both the local user and kernel levels. No specific affected versions or patches have been disclosed yet.

CVE-2026-59564 is a critical authentication bypass vulnerability in the communication between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal. This flaw is categorized under CWE-304, indicating a missing critical step in the authentication process. The vulnerability allows unauthenticated attackers to bypass authentication controls, potentially leading to unauthorized access with high confidentiality and integrity impact. No specific affected versions or patch information are provided at this time.

An incorrect startup configuration of affected versions of Zscaler Client Connector on Windows may cause a limited amount of traffic from being inspected under rare circumstances.

Improper validation of user-supplied input in the ZIA Admin UI could allow an authenticated administrator to initiate backend functions through specific input fields in limited scenarios.

Improper neutralization of special elements in user-supplied input within the ZIA Admin UI could allow an authenticated administrator to access or retrieve unauthorized internal information in rare conditions.

A health check port on Zscaler Client Connector on Windows, versions 4.6 < 4.6.0.216 and 4.7 < 4.7.0.47, which under specific circumstances was not released after use, allowed traffic to potentially bypass ZCC forwarding controls.

An improper verification of cryptographic signature in Zscaler's SAML authentication mechanism on the server-side allowed an authentication abuse.

An improper verification of a loaded library in Zscaler Client Connector on Mac < 4.2.0.241 may allow a local attacker to elevate their privileges.