{"id":"CVE-2026-25687","aliases":["EUVD-2026-77536","GHSA-4wwc-hgc4-j27v"],"status":"published","title":"ZCC race condition in ZPA tunnel handler","description":"A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0038,"percentile":0.32429,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-366"],"published":"2026-09-14T14:37:04Z","modified":"2026-09-18T19:08:02Z","products":[{"vendor":"zscaler","product":"client connector"}],"references":[{"url":"https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2026"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25687"},{"url":"https://github.com/advisories/GHSA-4wwc-hgc4-j27v"}],"sources":{"cve":[{"id":"CVE-2026-25687","title":"ZCC race condition in ZPA tunnel handler","description":"A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.","status":"published","published":"2026-09-14T14:37:04.331Z","modified":"2026-09-15T03:56:03.896Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-366"],"updated_at":"2026-11-02T13:41:30.911526Z"}],"euvd":[{"id":"EUVD-2026-77536","description":"A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.","status":"published","published":"2026-09-14T14:37:04Z","modified":"2026-09-15T03:56:03Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:19.01786Z"}],"ghsa":[{"id":"GHSA-4wwc-hgc4-j27v","title":"A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC)...","description":"A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.","status":"published","published":"2026-09-14T15:32:48Z","modified":"2026-09-14T15:32:56Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-366"],"updated_at":"2026-11-02T15:11:50.762382Z"}],"nvd":[{"id":"CVE-2026-25687","description":"A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.","status":"published","published":"2026-09-14T15:17:05.09Z","modified":"2026-09-18T19:08:02.707Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-366"],"updated_at":"2026-11-02T14:12:46.980627Z"}]}}