CVE-2023-28803: Zscaler Client Connector

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypass. This issue affects Client Connector: before 3.9.

Affected products

• Zscaler Client Connector: before 3.9 (fixed in 3.9)

Published 2023-10-23. Last modified 2026-06-17.