CVE-2024-23459

Multiple Arbitrary Creates/Overwrites by link following

7.1 High

An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allows a system file to be overwritten.This issue affects Zscaler Client Connector on Mac : before 3.7.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: High

Exploit likelihood

0.47%Up 0.4 points since May 3, 2024

What each source reports

CVE List Score used 7.1

Multiple Arbitrary Creates/Overwrites by link following

Record: CVE-2024-23459
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-59
Updated: 2026-11-02

EUVDEUVD-2024-20957 7.1

Record: EUVD-2024-20957
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9gh8-72qr-qfc7 7.1

An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client...

Record: GHSA-9gh8-72qr-qfc7
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-59
Updated: 2026-11-02

NVD 7.1

Record: CVE-2024-23459
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-59
Updated: 2026-11-02

Affected products

zscaler client connector

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-23459 is a high vulnerability (CVSS 7.1) in Zscaler Client Connector, published May 2, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 41st percentile. No source names a fixed version.