CVE-2026-25687 — ZCC race condition in ZPA tunnel handler
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and p…
Published: 2026-09-14 · CVSS: 8.1 · CVSS 3.1
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7