556 matches found
tools
Zscaler ThreatLabz Tools Tools developed by the Zscaler ThreatLabz Threat Intelligence team Follow us on Twitter: @Threatlabz Blog: https://www.zscaler.com/blogs/security-research...
iocs
Zscaler ThreatLabz IOCs This repository contains Indicators of Compromise IOCs from the Zscaler ThreatLabz team. Follow us on Twitter: @Threatlabz Blog: https://www.zscaler.com/blogs/security-research...
CVE-2023-41717
CVE-2023-41717 Zscaler Proxy バージョン 3.6.1.25 以前における不適切なファイルタイプ制御により、ローカル攻撃者がファイルのダウンロード/アップロード制限をバイパスできる脆弱性。 エグゼクティブサマリー 2022年夏、私は ZScaler プロキシ（バージョン 3.6.1.25 以前）に影響する脆弱性を発見しました。この脆弱性により、ローカル攻撃者は Burp などのツールや、Background Intelligent Transfer Service（BITS）プロトコルを利用する Microsoft 標準の Bitsadmin...
bug-bounty-reports-desai-vinayak
🧩 Bug Bounty Reports — Desai Vinayak 🔒 Bug bounty and vulnerability research reports by Desai Vinayak. This repository collects passive, non-destructive vulnerability write-ups and supporting evidence for coordinated disclosure and remediation tracking. 📁 Contents 📂 reports/ — PDF, DOCX, and...
CVE-2026-59563
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2...
CVE-2026-59563 HMAC Confirmation Token Unbinding in zscaler-mcp-server
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2...
EUVD-2026-88244
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2...
CVE-2026-59563
The Zscaler MCP Server versions 0.7.0 and 0.7.1 are vulnerable to a token replay issue. The root cause is that HMAC confirmation tokens are not bound to the target resource identifier. This allows an MCP client or agent to replay a token intended for one resource to impact another resource of the...
CVE-2026-59563 HMAC Confirmation Token Unbinding in zscaler-mcp-server
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2...
CVE-2026-59563: Authentication Bypass by Primary Weakness
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2...
CVE-2026-25684
A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances...
CVE-2026-25684 File Type Control rule bypass
A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances...
CVE-2026-25684 File Type Control rule bypass
A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances...
EUVD-2026-82928
A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances...
CVE-2026-25684
CVE-2026-25684 identifies a file type attribution issue in Zscaler Internet Access File Type Control evaluation rules. This may allow improper evaluation of File Type Control policies in rare circumstances, where a file's type is incorrectly attributed, potentially causing policy rules to be bypa...
CVE-2026-25684: Improper Input Validation
A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances...
CVE-2026-59570
On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture...
CVE-2026-59569
An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls...
CVE-2026-25687
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector ZCC allows a heap corruption, resulting in a denial of service client crash and potentially arbitrary code execution in the context of the ZCC process...