Client Connector vulnerability

What happened

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.

Affected versions

Client Connector: 4.6 through before 4.6.0.486 (custom); 4.7 through before 4.7.0.350 (custom); 4.8 through before 4.8.0.267 (custom); 4.9 through before 4.9.0.412 (custom) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.