CVE-2026-25687

The verdict

A race condition in the ZPA tunnel handler in Zscaler Client Connector can corrupt the heap, crashing the client and potentially letting an attacker run code in the ZCC process. Exploitation requires winning a race, which raises the difficulty, but a successful hit could give an attacker code execution with the privileges of the Zscaler client process. CVSS 8.1.

Patch urgency · Patch within 24 hours