Unauthenticated remote code execution in Zscaler Client Connector

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context.

The CNA record uses custom platform-qualified ranges. The default status is recorded as unaffected, while releases below the following boundaries are marked affected:

• Windows: below 4.6.0.457, 4.7.0.317, 4.8.0.232, or 4.9.0.372, as applicable to the branch.
• macOS: below 4.5.2.312, 4.7.0.292, or 4.8.0.191, as applicable to the branch.
• Linux: below 3.7.2.64 or 4.2.1.64, as applicable to the branch.
• Android: below 4.2.
• ChromeOS: below 4.2.
• iOS: below 4.5.1.

These are the platform-specific boundaries supplied by the CNA. Do not infer that one boundary applies to another branch or platform.

Zscaler Client Connector is the affected component and the record classifies the weakness as CWE-20 Improper input validation. Confirmed attack conditions are network reachability, low complexity, no authentication, no privileges, and no user interaction. At a high level, an attacker can send input to reachable Client Connector functionality, the input is handled unsafely, and arbitrary code executes in the ZCC context. The specific endpoint, protocol, payload, vulnerable module, and validation failure are not disclosed, so this is a high-level technical interpretation rather than exploit guidance. The affected scope spans Client Connector deployments on Windows, macOS, Linux, Android, ChromeOS, and iOS.

The issue is remotely reachable over the network. The record confirms that an attacker does not need authentication or privileges, does not need user interaction, and faces low attack complexity. The supplied record does not identify a public exploit and does not mark the issue as known exploited; a CISA coordinator enrichment returned during research records exploitation as none within its assessment scope. That status does not prove exploitation cannot occur or that it cannot change. No exploit details, campaign, victim, or specific indicator of compromise is provided.

The technical outcome is arbitrary code execution within the ZCC context, with high confidentiality and integrity impact in the supplied assessment; availability impact is not assessed. The record marks scope as unchanged, so it does not establish escape from the ZCC context, operating-system privilege escalation, or compromise of other systems. Depending on the permissions available to Client Connector, an attacker could potentially access or alter data, configuration, or activity managed by that context. Organisational consequences may include loss of endpoint trust, unauthorised changes to security behaviour, or exposure of data handled by Client Connector. The actual extent remains dependent on platform, deployment permissions, and additional controls.

• Successful exploitation could allow an attacker to read or modify data and behavior accessible to the ZCC context, with high assessed confidentiality and integrity impact.
• Because no account or user action is required, an exposed endpoint could be affected without assistance from a local user.
• The practical scope depends on ZCC permissions, the platform, and deployment configuration. The record does not establish escape from the ZCC context, operating-system takeover, or impact to other systems.
• The record contains no evidence of a specific breach, victim, or campaign.

1. Inventory all Client Connector deployments across the six affected platforms and identify the release branch used by each endpoint.
2. For Windows, update each branch to the corresponding CNA-listed boundary: 4.6.0.457, 4.7.0.317, 4.8.0.232, or 4.9.0.372.
3. For macOS, update to the applicable boundary: 4.5.2.312, 4.7.0.292, or 4.8.0.191. For Linux, update to 3.7.2.64 or 4.2.1.64, as applicable to the branch.
4. For Android and ChromeOS, update to 4.2. For iOS, update to 4.5.1.
5. Use the Zscaler Client Connector App Store, a Zscaler-supported update mechanism, or the appropriate MDM workflow for each platform, then verify the deployed version on the actual endpoints. The supplied solutions field is empty, so consult Zscaler release guidance to confirm the deployment process and supported upgrade path for each branch.
6. Until updates are complete, limit unnecessary network reachability to affected endpoints where operationally feasible. This is a defense-in-depth measure, not a vendor-confirmed fix.

• Inventory all Client Connector deployments on Windows, macOS, Linux, Android, ChromeOS, and iOS using endpoint inventory, the Zscaler portal, MDM, or software-management tools.
• Collect the exact installed version on each endpoint and compare it with the platform-specific boundaries in affected_summary.
• Prioritize endpoints that are reachable over the network because the issue does not require authentication or user interaction.
• Review EDR and network telemetry for anomalous code execution or unexpected network activity associated with Client Connector on exposed hosts. This is precautionary monitoring, not a confirmed IOC.
• Check offline devices, incomplete rollout groups, and centrally reported update status. The absence of an alert or log event does not prove that an endpoint is safe.