Configuration error in Zscaler Client Connector on Windows allows a small portion of outbound traffic to bypass the inspection engine. Because the client starts with an incorrect startup profile, traffic destined for protected resources can evade the policy rules that normally enforce encryption, filtering or blocking. The flaw reduces the confidentiality protection the product promises without compromising the host or enabling arbitrary code execution.

Any Windows deployment of Zscaler Client Connector that has not applied the latest configuration update. The advisory does not list specific version ranges, so all releases prior to the recent release summary are potentially affected.

The CVSS score of 5.4 denotes moderate severity. Exploit likelihood is unknown as EPSS data is not available, and the vulnerability is not present in the CISA KEV catalog. The attack requires the client to start with the faulty configuration, which is likely to occur during a normal user login or startup sequence. Once the traffic bypasses the engine, an attacker only gains the ability to exfiltrate data that would otherwise be inspected, but not full system compromise.