Client Connector
CVE-2026-25687: ZCC race condition in ZPA tunnel handler
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Client Connector (Windows) 4.6 | 4.6.0.486 or later |
| Client Connector (Windows) 4.7 | 4.7.0.350 or later |
| Client Connector (Windows) 4.8 | 4.8.0.267 or later |
| Client Connector (Windows) 4.9 | 4.9.0.412 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.