https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-23483.htmlhttps://patchthecve.com/cve/CVE-2024-23483.htmlWed, 17 Jun 2026 07:13:02 +0000HIGH 7.0: An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection. This issue affects Zscaler Client Connector on MacOS <4.2.https://patchthecve.com/cve/CVE-2024-23464.htmlhttps://patchthecve.com/cve/CVE-2024-23464.htmlWed, 17 Jun 2026 07:13:00 +0000HIGH 7.2: In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows <4.2.1https://patchthecve.com/cve/CVE-2024-23460.htmlhttps://patchthecve.com/cve/CVE-2024-23460.htmlWed, 17 Jun 2026 07:12:59 +0000MEDIUM 6.4: The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This affects Zscaler Client Connector on MacOS <4.2.https://patchthecve.com/cve/CVE-2024-23458.htmlhttps://patchthecve.com/cve/CVE-2024-23458.htmlWed, 17 Jun 2026 07:12:59 +0000HIGH 7.3: While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privilege escalation. This issue affects Zscaler Client Connector on Windows <4.2.0.190.https://patchthecve.com/cve/CVE-2024-23456.htmlhttps://patchthecve.com/cve/CVE-2024-23456.htmlWed, 17 Jun 2026 07:12:59 +0000HIGH 7.8: Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with anti-tampering enabled.https://patchthecve.com/cve/CVE-2023-28806.htmlhttps://patchthecve.com/cve/CVE-2023-28806.htmlWed, 17 Jun 2026 05:48:48 +0000MEDIUM 5.7: An Improper Validation of signature in Zscaler Client Connector on Windows allows an authenticated user to disable anti-tampering. This issue affects Client Connector on Windows <4.2.0.190.https://patchthecve.com/cve/CVE-2024-23462.htmlhttps://patchthecve.com/cve/CVE-2024-23462.htmlWed, 17 Jun 2026 07:12:59 +0000LOW 3.3: An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS allows a denial of service of the Client Connector binary and thus removing client functionality.This issue affects Client Connector on MacOS: before 3.4. https://patchthecve.com/cve/CVE-2024-23461.htmlhttps://patchthecve.com/cve/CVE-2024-23461.htmlWed, 17 Jun 2026 07:12:59 +0000MEDIUM 4.2: An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS during the upgrade process may allow a Local Execution of Code.This issue affects Client Connector on MacOS: before 3.4. https://patchthecve.com/cve/CVE-2024-23459.htmlhttps://patchthecve.com/cve/CVE-2024-23459.htmlWed, 17 Jun 2026 07:12:59 +0000HIGH 7.1: An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allows a system file to be overwritten.This issue affects Zscaler Client Connector on Mac : before 3.7. https://patchthecve.com/cve/CVE-2023-41971.htmlhttps://patchthecve.com/cve/CVE-2023-41971.htmlWed, 17 Jun 2026 06:23:10 +0000MEDIUM 5.3: An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Windows allows a system file to be overwritten.This issue affects Client Connector on Windows: before 3.7. https://patchthecve.com/cve/CVE-2023-41970.htmlhttps://patchthecve.com/cve/CVE-2023-41970.htmlWed, 17 Jun 2026 06:23:10 +0000MEDIUM 6.0: An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on Windows during the Repair App functionality may allow Local Execution of Code.This issue affects Client Connector on Windows: before 4.1.0.62. https://patchthecve.com/cve/CVE-2023-28798.htmlhttps://patchthecve.com/cve/CVE-2023-28798.htmlWed, 17 Jun 2026 05:48:47 +0000MEDIUM 6.5: An out-of-bounds write to heap in the pacparser library on Zscaler Client Connector on Mac may lead to arbitrary code execution.https://patchthecve.com/cve/CVE-2024-23480.htmlhttps://patchthecve.com/cve/CVE-2024-23480.htmlWed, 17 Jun 2026 07:13:02 +0000HIGH 7.5: A fallback mechanism in code sign checking on macOS may allow arbitrary code execution. This issue affects Zscaler Client Connector on MacOS prior to 4.2. https://patchthecve.com/cve/CVE-2024-23457.htmlhttps://patchthecve.com/cve/CVE-2024-23457.htmlWed, 17 Jun 2026 07:12:59 +0000HIGH 7.8: The anti-tampering functionality of the Zscaler Client Connector can be disabled under certain conditions when an uninstall password is enforced. This affects Zscaler Client Connector on Windows prior to 4.2.0.209 https://patchthecve.com/cve/CVE-2024-23463.htmlhttps://patchthecve.com/cve/CVE-2024-23463.htmlWed, 17 Jun 2026 07:13:00 +0000HIGH 8.8: Anti-tampering protection of the Zscaler Client Connector can be bypassed under certain conditions when running the Repair App functionality. This affects Zscaler Client Connector on Windows prior to 4.2.1 https://patchthecve.com/cve/CVE-2024-23482.htmlhttps://patchthecve.com/cve/CVE-2024-23482.htmlWed, 17 Jun 2026 07:13:02 +0000HIGH 7.0: The ZScaler service is susceptible to a local privilege escalation vulnerability found in the ZScalerService process. Fixed Version: Mac ZApp 4.2.0.241 and later. https://patchthecve.com/cve/CVE-2023-41973.htmlhttps://patchthecve.com/cve/CVE-2023-41973.htmlWed, 17 Jun 2026 06:23:10 +0000HIGH 7.3: ZSATray passes the previousInstallerName as a config parameter to TrayManager, and TrayManager constructs the path and appends previousInstallerName to get the full path of the exe. Fixed Version: Win ZApp 4.3.0.121 and later. https://patchthecve.com/cve/CVE-2023-41972.htmlhttps://patchthecve.com/cve/CVE-2023-41972.htmlWed, 17 Jun 2026 06:23:10 +0000HIGH 7.3: In some rare cases, there is a password type validation missing in Revert Password check and for some features it could be disabled. Fixed Version: Win ZApp 4.3.0.121 and later.https://patchthecve.com/cve/CVE-2023-41969.htmlhttps://patchthecve.com/cve/CVE-2023-41969.htmlWed, 17 Jun 2026 06:23:10 +0000HIGH 7.3: An arbitrary file deletion in ZSATrayManager where it protects the temporary encrypted ZApp issue reporting file from the unprivileged end user access and modification. Fixed version: Win ZApp 4.3.0 and later.