CVE-2023-41972 is a high severity flaw (CVSS 7.3) in Zscaler Client Connector for Windows. Per the NVD record, a password type validation is missing in the Revert Password check, and some features could be disabled as a result. Zscaler lists Win ZApp 4.3.0.121 and later as fixed.
What's affected
The record lists the Zscaler Client Connector on Windows. The affected range is given as all versions in the NVD configuration data, with the fix stated in the description: "Fixed Version: Win ZApp 4.3.0.121 and later."
The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. In plain terms the attacker needs local access and a low privilege account, no user interaction, and the impact scores are high for confidentiality and integrity and low for availability. The weakness class is CWE-280.
The record is short. It does not say which features can be disabled, and it does not describe how the check is reached. Treat anything beyond that description as unconfirmed.
How to check if you're exposed
Find the Client Connector version on each Windows endpoint. In the app, open the About or version view, or read the installed version from the registry:
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
"HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" |
Where-Object { $_.DisplayName -like "*Zscaler*" } |
Select-Object DisplayName, DisplayVersion
Anything below 4.3.0.121 on the Windows line is in scope. If you manage the client through the Zscaler admin portal, the endpoint version list there gives you the same answer for the fleet. Check the vendor release summary for the exact release you are on.
What to do now
- List Windows endpoints running Client Connector below 4.3.0.121.
- Upgrade to 4.3.0.121 or a later release through your normal software distribution.
- Confirm the fix in the vendor release summary for 4.3.0.121 and note the release date it gives.
- Review who has local accounts on shared or kiosk-style Windows machines, since the vector needs local access.
- Record the upgrade in your asset inventory so the next audit can see it.
Why it matters
Client Connector is the agent that steers a device's traffic through the Zscaler service, and it often has a password or revert mechanism to stop users from turning it off. A missing validation on that check is a control that does not hold. The class, improper handling of insufficient permissions, means an action was allowed without the right proof.
The risk here is bounded by the local access requirement. This is not a remote flaw. It is most relevant on machines shared by several people or where users have standard accounts and you rely on the client staying on. The record does not mark this CVE as known exploited, and the KEV flag in the record is false.
Desktop agents are easy to forget in vulnerability programs because they do not show up in a package manifest. An endpoint inventory is the way to find them. The Gold directory page for this CVE tracks it alongside related records.
Quick check
Is this exploited in the wild?
Not according to the record, which has the CISA Known Exploited Vulnerabilities flag set to false. Check CISA's catalog again if your policy depends on it.
Does a fix exist?
Yes. The record states Win ZApp 4.3.0.121 and later as the fixed version. Confirm the details on the Zscaler release summary.
Sources
- NVD record for CVE-2023-41972
- Zscaler Client Connector 2023 release summary (the page returned no readable content when fetched, so the fixed version comes from the NVD description)
Last reviewed: 19 October 2026.
