# CVE-2026-25687: Zscaler Client Connector race condition in ZPA tunnel handler

Source: https://junglewise.ai/threats/cve-2026-25687-zscaler-client-connector-race-condition-in-zpa-tunnel-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-25687 · Severity: high · CVSS 8.1 · Published 2026-09-14

Zscaler Client Connector (ZCC) is a security agent installed on endpoints to route traffic through Zscaler's cloud security platform. A race condition flaw in its ZPA tunnel handler can corrupt memory, causing the client to crash (denial of service) or potentially allowing attackers to execute arbitrary code with the privileges of the ZCC process.

Technologies: [Zscaler Client Connector](https://junglewise.ai/threats/technologies/client-connector). Vendors: [Zscaler](https://junglewise.ai/threats/vendors/zscaler).

## Quick answers

**Is CVE-2026-25687 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25687 being exploited in the wild.

**How severe is CVE-2026-25687?** High severity, with a CVSS score of 8.1, published 14 September 2026.

**Which products and versions are affected?** Zscaler Client Connector <UNKNOWN>.

**Is there a fix for CVE-2026-25687?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-25687 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-25687?** Check whether you run Zscaler Client Connector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A race condition exists in the ZPA tunnel handler component of affected Zscaler Client Connector versions, leading to heap corruption. The vulnerability can be triggered by an attacker with network access to the ZPA tunnel protocol; no authentication is required. Successful exploitation results in client-side denial of service (application crash) and may enable arbitrary code execution in the context of the ZCC process, potentially compromising the endpoint's security posture.

## Affected products

- Zscaler Client Connector <UNKNOWN>

## Timeline

- 2026-09-14: disclosed

## References

- [https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2026](https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2026)

## Related threats

- [Zscaler Client Connector peer app access control bypass](https://junglewise.ai/threats/cve-2026-59570-zscaler-client-connector-peer-app-access-control-bypass)
- [Zscaler Client Connector improper input validation on Android and ChromeOS](https://junglewise.ai/threats/cve-2026-59569-zscaler-client-connector-improper-input-validation-on-android-and)
- [Zscaler Client Connector remote code execution](https://junglewise.ai/threats/cve-2026-59568-zscaler-client-connector-remote-code-execution)
- [Zscaler Client Connector local privilege escalation](https://junglewise.ai/threats/cve-2026-59567-zscaler-client-connector-local-privilege-escalation)
- [Zscaler Client Connector buffer overflow on Android and ChromeOS](https://junglewise.ai/threats/cve-2026-59566-zscaler-client-connector-buffer-overflow-on-android-and-chromeos)