CVE-2021-26735

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversary may be able to execute code with SYSTEM privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-346CWE-428

Affected software

No affected versions have been published.

Timeline

Published
Oct 23, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-267367.8Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries frCVE-2021-267374.7The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients. A local adversary without sufficient privilegCVE-2021-267387.8Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local adversary may be abCVE-2021-267399.8SQL Injection vulnerability in pay.php in millken doyocms 2.3, allows attackers to execute arbitrary code, via the attribute parameter.CVE-2021-267409.8Arbitrary file upload vulnerability sysupload.php in millken doyocms 2.3 allows attackers to execute arbitrary code.CVE-2021-267466.1Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI.CVE-2021-267479.8Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading to remote code executCVE-2021-267507.8DLL hijacking in Panda Agent <=1.16.11 in Panda Security, S.L.U. Panda Adaptive Defense 360 <= 8.0.17 allows attacker to escalate privilegesCVE-2021-267518.8NeDi 1.9C allows an authenticated user to perform a SQL Injection in the Monitoring History function on the endpoint /Monitoring-History.phpCVE-2021-267528.8NeDi 1.9C allows an authenticated user to execute operating system commands in the Nodes Traffic function on the endpoint /Nodes-Traffic.phpCVE-2021-267539.9NeDi 1.9C allows an authenticated user to inject PHP code in the System Files function on the endpoint /System-Files.php via the txt HTTP POCVE-2021-267549.8wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=get_wdtable order[0][dir] SQL injecti
CVE-2021-26735: High severity, CVSS 7.8 | Vulnix