Privilege Escalation for ZCC macOS via PATH Variable

CVE-2021-26738

What is CVE-2021-26738?

The Zscaler Client Connector for macOS versions prior to 3.7 contains an unquoted search path vulnerability in its handling of the PATH variable. This flaw allows local attackers to potentially execute arbitrary code with elevated privileges, posing significant security risks. Users are advised to update to the latest version to mitigate these vulnerabilities effectively.

References