Zscaler
Vulnerability activity for Zscaler: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 5
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 8
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 4.6MediumSep 28, 2026zscaler-mcp-server Auth bypass / access controlCVE-2026-59563Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2.
- 4.4MediumSep 18, 2026Zscaler ZIA File Type ControlCVE-2026-25684A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances.
- 7.5HighSep 14, 2026Zscaler Client ConnectorCVE-2026-59570On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture.
- 8.1HighSep 14, 2026Zscaler Client ConnectorCVE-2026-59569An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls.
- 8.1HighSep 14, 2026Zscaler Client Connector Code / command injectionCVE-2026-25687A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.
- 5.4MediumMar 31, 2026Zscaler client connectorCVE-2026-22569An incorrect startup configuration of affected versions of Zscaler Client Connector on Windows may cause a limited amount of traffic from being inspected under rare circumstances.
- 5.5MediumFeb 23, 2026zscaler internet access admin portalCVE-2026-22568Improper neutralization of special elements in user-supplied input within the ZIA Admin UI could allow an authenticated administrator to access or retrieve unauthorized internal information in rare conditions.
- 7.6HighFeb 23, 2026zscaler internet access admin portalCVE-2026-22567Improper validation of user-supplied input in the ZIA Admin UI could allow an authenticated administrator to initiate backend functions through specific input fields in limited scenarios.
Top products
- Client Connector4 CVEs in the last year
- zscaler internet access admin portal2 CVEs in the last year
- zscaler-mcp-server1 CVE in the last year
- ZIA File Type Control1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.