CVE-2024-23464 Zscaler bypass with administrative privileges on Windows

Q: Is CVE-2024-23464 being exploited?

There is no known exploitation of CVE-2024-23464 in the wild and no public exploit code.

Q: How do I fix CVE-2024-23464?

No fix has been published for CVE-2024-23464 yet. Limit exposure of the affected software until one is available.

High 7.2 Published 6 Aug 2024 Updated 6 Aug 2024

Administrators can bypass Zscaler Internet Access security controls on Windows using PowerShell commands, requiring an upgrade to the Client Connector.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-23464?

CVE-2024-23464 is a high-severity vulnerability in Zscaler Client Connector, published on 6 Aug 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows <4.2.1

Weakness: CWE-281

Which versions are affected by CVE-2024-23464?

It affects 1 product.

Products include Zscaler Client Connector.

How do I fix CVE-2024-23464?

No fix has been published for CVE-2024-23464 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-23464 being exploited?

There is no known exploitation of CVE-2024-23464 in the wild and no public exploit code.

Sources

Also known as GHSA-3hrv-ghrw-48w6.