Zscaler Client Connector local privilege escalation enables privileged code execution

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in a privileged context.

Zscaler Client Connector is marked affected by default on these platforms:

• Windows: versions less than 4.6.0.457, 4.7.0.317, 4.8.0.232, and 4.9.0372 are marked affected.
• macOS: versions less than 4.5.2.312, 4.7.0.292, and 4.8.0.191 are marked affected.
• Linux: versions less than 3.7.2.64 and 4.2.1.64 are marked affected.

The record uses custom version expressions and describes boundaries by platform branch. It does not establish status for parallel branches, other operating systems, or unlisted builds; a boundary for one branch must not be treated as evidence that another branch is unaffected.

Zscaler Client Connector is affected by multiple vulnerabilities classified under CWE-280, involving improper handling of permissions or privileges. At a high level, a local unprivileged user can abuse one or more of these defects to cause arbitrary code to execute in a privileged context. The affected deployments are identified as Windows, macOS, and Linux. The supplied attack description indicates local access, low complexity, low privileges, and no user interaction. The available evidence does not identify the vulnerable service, IPC path, driver, file, interface, or input format, so a more specific attack sequence would be speculative.

The vulnerability is locally reachable rather than directly remotely reachable, and the attacker needs access through an unprivileged local account. The assessed complexity is low and no user interaction is required. The supplied record does not identify a public exploit; available enrichment records exploitation as none and automatable as no. These are bounded status assessments, not proof that exploitation cannot occur in the future. No specific campaign, victim, or exploit tool is named in the available evidence.

Successful exploitation could allow an unprivileged local user to execute arbitrary code in a privileged context. The technical result is a privilege-boundary crossing with potential effects on endpoint confidentiality, integrity, and availability. Because the vector records changed scope, privileged code could affect resources outside the directly vulnerable component, but those resources are not identified. The record does not state whether a particular deployment configuration limits the privileges available to the Client Connector context.

If successfully exploited, an unprivileged local user could cross the Client Connector privilege boundary and run code with higher privileges.

• This could expose or alter data that the original user context could not access.
• Code running with elevated privileges could weaken security controls, modify endpoint state or components, and disrupt device operation.
• Because the assessment describes changed scope, effects could extend beyond the directly vulnerable component, although the specific resources are not identified.

The available evidence does not name a breach, victim, campaign, or specific operational loss.

1. Update by platform branch: move each installation out of the affected lessThan range by deploying the corresponding Zscaler release for that branch. The record lists Windows boundaries of 4.6.0.457, 4.7.0.317, 4.8.0.232, and 4.9.0372; macOS boundaries of 4.5.2.312, 4.7.0.292, and 4.8.0.191; and Linux boundaries of 3.7.2.64 and 4.2.1.64.
2. Verify after deployment that each endpoint is actually running a build in the remediated branch. Do not turn one branch boundary into a blanket rule for other current or future branches that the record does not confirm.
3. Prioritize endpoints accessible to unprivileged local users because exploitation requires local access.
4. The record provides no workaround or configuration-specific mitigation. If an update cannot be completed, obtain branch-specific guidance from Zscaler rather than assuming that an unverified configuration change removes the vulnerability.

1. Inventory all endpoints running Zscaler Client Connector on Windows, macOS, and Linux, including systems where unprivileged local users can sign in.
2. Compare each installed build with the platform-specific boundaries in affected_summary; do not infer safety from the product name, operating system, or release branch alone.
3. Review software deployment records or management data to confirm that the update completed on each endpoint, rather than only confirming that a package was distributed.
4. As a precaution, review endpoint telemetry for unexpected privileged process creation, unauthorized security configuration changes, or other privilege activity inconsistent with the expected deployment. The record provides no specific IOC or log event, and the absence of abnormal telemetry does not prove that an endpoint is safe.