Changeflow GovPing Data Privacy & Cybersecurity ZScaler Client Connector Data Manipulation Vuln...
Priority review Notice Added Final

ZScaler Client Connector Data Manipulation Vulnerability

Favicon for wid.cert-bund.de CERT-Bund Security Advisories
Published March 31st, 2026
Detected April 1st, 2026
Email

Summary

CERT-Bund published security advisory WID-SEC-2026-0938 disclosing a data manipulation vulnerability in ZScaler Client Connector. Affected versions prior to 4.8.0.63 and 4.7.0.141 on Windows systems have a CVSS Base Score of 5.4 (medium). A remote, anonymous attacker can exploit this flaw to manipulate data.

View original document View source feed page

What changed

CERT-Bund identified a vulnerability in ZScaler Client Connector (formerly Zscaler App/Z App) that allows a remote, unauthenticated attacker to manipulate data. The vulnerability affects Windows systems running versions below 4.8.0.63 and 4.7.0.141. The CVSS Base Score is 5.4 with a Temporal Score of 4.7.

Organizations using ZScaler Client Connector on Windows should immediately update to the patched versions (4.8.0.63 or 4.7.0.141 and above). Mitigation measures are available. No specific compliance deadline was provided in the advisory.

What to do next

  1. Update ZScaler Client Connector to version 4.8.0.63 or later (or 4.7.0.141 if using that branch)
  2. Verify all Windows endpoints are running patched versions
  3. Apply available mitigation measures if immediate patching is not feasible

Source document (simplified)

[WID-SEC-2026-0938] ZScaler Client Connector: Schwachstelle ermöglicht Manipulation von Daten CVSS Base Score 5.4 (mittel) CVSS Temporal Score 4.7 (mittel) Remoteangriff ja Datum 31.03.2026 Stand 01.04.2026 Mitigation ja

Betroffene Systeme

Betriebssystem

  • Windows

Produktbeschreibung

Zscaler Client Connector, ehemals Zscaler App (Z App) führt Sicherheits- und Richtlinienkontrollen auf verwalteten Endgeräten durch.

Produkte

31.03.2026
- ZScaler Client Connector <4.8.0.63

  • ZScaler Client Connector <4.7.0.141

Angriff

Angriff

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in ZScaler Client Connector ausnutzen, um Daten zu manipulieren. CVE Informationen Versionshistorie Feedback zum Advisory geben

Named provisions

Affected Systems Attack Vector Mitigation

Related changes

Favicon for wid.cert-bund.de M-Files Server Information Disclosure Vulnerability Advisory
Priority review Apr 02, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de Cisco Nexus Vulnerabilities Allow File Manipulation, Data Disclosure
Routine Apr 02, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de IGEL UMS Vulnerability Allows Remote Information Disclosure
Priority review Apr 02, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cssf.lu Active Supply Chain Attack Targeting Axios NPM
Urgent Apr 04, 2026 • CSSF News • Banking & Finance
Favicon for www.cert.ssi.gouv.fr SUSE Linux Kernel Multiple Vulnerabilities Advisory
Priority review Apr 03, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Ubuntu Linux Kernel Vulnerabilities Allow Arbitrary Code Execution
Priority review Apr 03, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Source

Favicon for wid.cert-bund.de
CERT-Bund Security Advisories wid.cert-bund.de/content/public/securityAdvisory/rss
Data Privacy & Cybersecurity
Analysis generated by AI. Source diff and links are from the original.

Classification

Agency
CERT-Bund
Published
March 31st, 2026
Instrument
Notice
Legal weight
Non-binding
Stage
Final
Change scope
Minor
Document ID
WID-SEC-2026-0938

Who this affects

Applies to
Technology companies Government agencies
Industry sector
5112 Software & Technology
Activity scope
Patch Management Endpoint Security
Geographic scope
Germany DE

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF NIST 800-53
Topics
Data Privacy Network Security

Browse Categories

Agriculture & Food Safety 63 AI Regulation 3 Banking & Finance 266 Consumer & Competition 1 Consumer Protection 43 Courts & Legal 358 Data Privacy & Cybersecurity 74 Defense & National Security 52 Education 20 Energy 101 Environment 85 Government & Legislation 274 Healthcare 135 Housing 16 Immigration 9 Insurance 58 Labor & Employment 113 Legal & Courts 1 medical-board 1 Pharma & Drug Safety 103 Securities & Markets 104 Tax 65 Tax & Revenue 1 Telecom & Technology 47 Trade & Sanctions 124 Transportation 57

Get Data Privacy & Cybersecurity alerts

Weekly digest. AI-summarized, no noise.

Free. Unsubscribe anytime.

Get alerts for this source

We'll email you when CERT-Bund Security Advisories publishes new changes.

Optional. Personalizes your daily digest.

Free. Unsubscribe anytime.