PatchTheCVEzscaler vulnerabilities
Recent CVEs affecting zscaler products. 8 tracked.
zscaler has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 8. Most recent: 2026-02-23. Highest priority: CVE-2024-23483 (score 38/100).
- CVE-2026-22568 MEDIUM 5.5 UPGRADE Improper neutralization of special elements in user-supplied input within the ZIA Admin UI could allow an auth
- CVE-2026-22567 HIGH 7.6 UPGRADE Improper validation of user-supplied input in the ZIA Admin UI could allow an authenticated administrator to i
- CVE-2024-23483 HIGH 7.0 UPGRADE An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection. T
- CVE-2024-23464 HIGH 7.2 UPGRADE In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights
- CVE-2024-23460 MEDIUM 6.4 UPGRADE The Zscaler Updater process does not validate the digital signature of the installer before execution, allowin
- CVE-2024-23458 HIGH 7.3 UPGRADE While copying individual autoupdater log files, reparse point check was missing which could result into crafte
- CVE-2024-23456 HIGH 7.8 UPGRADE Anti-tampering can be disabled under certain conditions without signature validation
- CVE-2023-28806 MEDIUM 5.7 UPGRADE An Improper Validation of signature in Zscaler Client Connector on Windows allows an authenticated user to dis
FAQ
How do I fix zscaler vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is zscaler being exploited right now?
None of the tracked zscaler CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which zscaler CVE should I patch first?
CVE-2024-23483 currently ranks highest (38/100): An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection. T.