CVE-2023-41969 is a high severity (CVSS 7.3) arbitrary file deletion flaw in ZSATrayManager, part of Zscaler Client Connector on Windows. The record says it is fixed in Win ZApp 4.3.0 and later. Update the client on Windows machines and check Zscaler's release notes for the details.
What's affected
The NVD record says the issue is in ZSATrayManager, concerning how it protects the temporary encrypted ZApp issue reporting file from access and modification by an unprivileged end user. It names the fixed version as Win ZApp 4.3.0 and later, so earlier Windows releases are affected.
The Zscaler release summary page the record links is rendered by script and returned no readable text, so we could not confirm the release note wording. Check it for the exact scope.
The record scores the flaw 7.3 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. It can be reached with local access to the machine, the attack complexity is low, it requires low privileges, and it needs no user interaction. The impact on confidentiality is high, on integrity high and on availability low. The weakness class is CWE-61 (UNIX symbolic link following). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
On each Windows machine, open the Zscaler Client Connector app and read its version from the app. Anything before 4.3.0 on Windows is in scope. If you manage the fleet from the Zscaler admin portal, its device list shows the client version per device.
Remember shared and virtual desktops. The vector shows a local attack path, so machines with several users matter most.
What to do now
- Find Windows machines that run Zscaler Client Connector before 4.3.0.
- Roll out Win ZApp 4.3.0 or later through your normal software deployment.
- Read the Zscaler release summary for the details.
- Restrict local sign in on shared machines.
Why it matters
The weakness is CWE-61, symbolic link following. A privileged service acts on a file path that a normal user can redirect with a link, so it ends up deleting a file the user should not be able to touch. Deleting the right file can break security tools or help an escalation.
The vector shows low privileges, no user interaction and high confidentiality and integrity impact, which explains the 7.3 score. Security agents run with high rights on every endpoint, so flaws in them deserve prompt patching.
Quick check
Is CVE-2023-41969 remote?
No. The vector shows a local attack path with low privileges.
Which version fixes it?
Win ZApp 4.3.0 and later, per the record.
Sources
- Zscaler Client Connector 2023 release summary (linked from the record; the page returned no readable text when we reviewed it)
- CVE-2023-41969 on Gold
Last reviewed: 19 October 2026.
