A high-severity race condition in Zscaler Client Connector allows unauthenticated attackers to trigger heap corruption, which may lead to service disruption or arbitrary code execution.

The vulnerability is a race condition (CWE-366) within the ZPA tunnel handler thread, which allows an unauthenticated attacker to induce heap corruption. This flaw enables potential arbitrary code execution within the security context of the ZCC process.

Successful exploitation poses a significant risk to organizational security, as the Zscaler Client Connector operates with elevated privileges to manage network traffic. A compromise could allow an attacker to bypass security controls, exfiltrate sensitive data, or render the Zscaler tunnel unusable, resulting in operational downtime. With a CVSS score of 8.1, this vulnerability is categorized as high risk due to its potential for total impact on confidentiality, integrity, and availability.

Immediate Action: Update all instances of Zscaler Client Connector to the specified fixed versions: 4.6.0.486, 4.7.0.350, 4.8.0.267, or 4.9.0.412.

Proactive Monitoring: Monitor endpoint logs for abnormal crashes or restarts of the ZCC process, which may indicate attempted exploitation of heap corruption.

Compensating Controls: Ensure endpoint security software is configured to detect and block suspicious child processes spawned by the Zscaler Client Connector service.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the critical role of Zscaler Client Connector in maintaining secure network connectivity, organizations must prioritize patching. Administrators should deploy the required updates across their device fleet immediately to eliminate the risk of heap corruption and subsequent system compromise.