CVE-2023-41971 is a medium severity (CVSS 5.3) improper link resolution flaw in Zscaler Client Connector on Windows. It allows a system file to be overwritten. Versions before 3.7 are affected, so update to 3.7 or later; current releases are better still.
What's affected
The NVD record says Client Connector on Windows before 3.7 is affected, and that the flaw can let a system file be overwritten. That puts the issue in a release line from 2021, so most up to date installs are already past it.
The Zscaler release summary linked from the record could not be read by our automated request. Check it if you need the exact release note wording.
The record scores the flaw 5.3 (Medium) with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H. It can be reached with local access to the machine, the attack complexity is high, it requires low privileges, and it needs no user interaction. The impact on confidentiality is no, on integrity low and on availability high. The weakness class is CWE-59 (improper link resolution before file access). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Open Zscaler Client Connector on a Windows machine and read the version. Anything before 3.7 is affected. Older machines that missed updates, lab images and gold images are the likely places to find old clients.
Check your deployment images too, since new machines built from an old image will bring the old client back.
What to do now
- Find Windows machines and images with Client Connector before 3.7.
- Update to a current release, which includes 3.7 and later fixes.
- Rebuild or patch gold images so new devices start current.
- Read the Zscaler release summary for further details.
Why it matters
The weakness is CWE-59, improper link resolution before file access, also known as link following. A privileged process follows a link a normal user can plant, and so writes to a file the user could not otherwise reach. That is how a system file can be overwritten.
The vector shows high complexity, low privileges and a high impact on availability only. The realistic worry is breaking a system file rather than stealing data. It is an old issue, but old clients linger in images.
Quick check
Is this likely to affect current installs?
Probably not. The affected range is before 3.7, an older release line. Old images and neglected machines are the risk.
What does it affect most?
The vector shows a high availability impact and a low integrity impact, with no confidentiality impact.
Sources
- Zscaler Client Connector 2021 release summary, version 3.7 (linked from the record; not retrieved)
- CVE-2023-41971 on Gold
Last reviewed: 19 October 2026.
