Improper validation of user‑supplied input in the ZIA Admin UI allows an authenticated administrator to trigger specific backend functions through certain input fields. This flaw can lead to the execution of unintended operations within the backend, potentially giving the attacker the ability to alter settings or perform actions that should be restricted to authorized contexts.

The vulnerability affects all versions of Zscaler ZIA Admin UI that lack the specified input validation fix. No specific version range is provided, so any instance of the ZIA Admin UI prior to the corrective release is considered vulnerable.

The CVSS score of 7.6 indicates a high severity, but the EPSS score of less than 1% and absence from the CISA KEV catalog suggest a low likelihood of widespread exploitation. The attack vector requires an authenticated administrative session and is limited to specific UI scenarios, so the risk is primarily for organizations with compromised or mismanaged admin credentials.