8.1
CVE-2026-25687
- EPSS 0.23%
- Veröffentlicht 14.09.2026 14:37:04
- Zuletzt bearbeitet 18.09.2026 19:08:02
- Erkennungen
ZCC race condition in ZPA tunnel handler
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerZscaler
≫
Produkt
Client Connector
Default Statusunaffected
Version
4.6
Version <
4.6.0.486
Status
affected
Version
4.7
Version <
4.7.0.350
Status
affected
Version
4.8
Version <
4.8.0.267
Status
affected
Version
4.9
Version <
4.9.0.412
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.23% | 0.141 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| cve@zscaler.com | 8.1 | 2.2 | 5.9 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-366 Race Condition within a Thread
If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.
https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2026