Description

On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-14T15:17:06.720Z",
  "pubdate": "2026-09-14T15:17:06.720Z",
  "executiveSummary": "This vulnerability involves an improper authorization mechanism within the Zscaler Client Connector that allows a pre-installed, non-privileged peer application to interact with and command core service functions. The vulnerability manifests as an unauthorized inter-process communication (IPC) channel exploitation, enabling a secondary application to manipulate the security agent's operational state without requiring administrative privileges.\nThe primary impact of this flaw includes the forced termination of encrypted tunnels, the involuntary logout of the authenticated user session, and the unauthorized initiation of packet capture functions. Such actions compromise the confidentiality and integrity of the network traffic protected by the Zscaler infrastructure and potentially expose sensitive diagnostic data.\nThis issue affects specific versions of the Zscaler Client Connector. By leveraging the exposed IPC mechanism, an attacker or a malicious local peer application can effectively disable security controls, potentially leading to a security bypass or the interception of network communications. No specific authentication is required from the attacker, provided they have the ability to execute a peer application on the target endpoint. This flaw represents a significant risk to organizational security policies that rely on the persistent operation of the Zscaler Client Connector to enforce Zero Trust connectivity.",
  "technicalDetails": "The vulnerability resides in the Zscaler Client Connector's IPC interface, which fails to adequately validate the identity or integrity of calling processes attempting to invoke sensitive management functions. The Zscaler Client Connector maintains a service that listens for commands to manage tunnel state, session status, and diagnostic tools, such as packet capturing. However, the interface lacks robust access control lists (ACLs) or authentication tokens to ensure that only authorized, signed processes can issue these commands.\nThe attack flow begins when an attacker or an already installed malicious application on the local system initiates communication with the Zscaler Client Connector service via the exposed IPC endpoint (such as a local socket or named pipe). Because the service does not perform sufficient validation on the calling process's credentials, it accepts the IPC requests as legitimate instructions from the user or the operating system.\nUpon establishing communication, the malicious peer application can send crafted commands to the Zscaler service. Specifically, the attacker can invoke functions responsible for tunnel teardown, which results in the immediate drop of the established encrypted tunnel connection. By invoking the logout command, the attacker can invalidate the user's session token, effectively performing a Denial of Service (DoS) against the connectivity solution. Furthermore, by accessing the packet capture interface, an unauthorized party can force the agent to dump network traffic to a location where it might be intercepted or exfiltrated, leading to a breach of privacy and potential exposure of internal network metadata.\nThe root cause is the lack of process verification and insufficient authorization checks for management API calls. Since the Zscaler Client Connector operates with high system privileges to manage network interfaces and routing tables, the ability for a standard user-mode process to influence its state constitutes a privilege escalation and a direct bypass of the agent's security policies. There is no requirement for elevated privileges on the part of the attacking application, making this vulnerability accessible to any software running within the local user context of the affected system."
}