← CVE Intelligence

CVE-2026-25687

ZCC race condition in ZPA tunnel handler PUBLISHED

Description (CNA)

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.

Affected (CNA)

Vendor / productVersions
Zscaler / Client Connectoraffected 4.6 before 4.6.0.486; affected 4.7 before 4.7.0.350; affected 4.8 before 4.8.0.267; affected 4.9 before 4.9.0.412

CWE

CWE-366

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.