CVE-2021-26735: 
Zscaler Client Connector vulnerability analysis and mitigation

The Zscaler Client Connector Installer and Uninstallers for Windows prior to version 3.6 contained an unquoted search path vulnerability identified as CVE-2021-26735. This security flaw could allow a local adversary to execute code with SYSTEM privileges (NVD).

The vulnerability is classified as an unquoted search path vulnerability (CWE-428) and has a CVSS v3.1 base score of 7.8 (HIGH) according to NIST's assessment. The attack vector is local (AV:L), with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R). The scope is unchanged (S:U) with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code with SYSTEM privileges, potentially leading to complete system compromise. The high impact ratings across confidentiality, integrity, and availability indicate that successful exploitation could result in significant system-wide consequences (NVD).

The vulnerability has been fixed in Zscaler Client Connector version 3.6 and later. Users are advised to upgrade to the latest version of the software to mitigate this security risk (Release Notes).