An authenticated administrator can, under rare conditions, retrieve internal data that should not be accessible. The flaw arises from improper handling of special characters in user input within the Admin UI, leading to an information disclosure vulnerability. The associated weakness is input validation failure (CWE‑20). As a result, confidentiality of internal data may be compromised for those with administrative access.

The vulnerability affects the Zscaler ZIA Admin UI. No specific version numbers are listed, but the vendor advisory recommends applying the latest update released on 2026‑02‑12 or later.

The CVSS base score of 5.5 indicates a moderate severity. The EPSS score of < 1% suggests a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated administrator, so the threat is limited to those with privileged access and operates under rare conditions, reducing overall risk but still actionable.