CVE-2023-28801
📛 CVE Title
Improper SAML signature verification
Description
An Improper Verification of Cryptographic Signature in the SAML authentication of the Zscaler Admin UI allows a Privilege Escalation.This issue affects Admin UI: from 6.2 before 6.2r.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- Zscaler
- CVSS severity
- CRITICAL
- CVSS score
- 9.6 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N- Effective score
- 9.6 / 10 CRITICAL source: CNA overview
- CWE(s)
-
CWE-347 - Reserved
- 2023-03-23
- Published
- 2023-08-31 15:53 UTC
- Last updated
- 2024-10-01 19:51 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28801.json
- Linked Threat
- CVE-2023-28801 — Improper SAML signature verification
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2023-08-31 14:15:08 UTC
- NVD last modified
- 2026-06-17 05:48:48 UTC
- NVD CVSS v3.1
- 9.6 / 10 CRITICAL source: cve@zscaler.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N- Exploitability subscore
- 3.1 / 10
- Impact subscore
- 5.8 / 10
- EPSS score
- 0.0033 (probability of exploitation in next 30 days)
- EPSS percentile
- 25.08% vs all CVEs — higher = more likely to be exploited, as of 2026-07-27
NVD / KEV / EPSS data refreshed 2026-07-28 05:35 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2023-32436 - Assigner
- Zscaler
- Published
- Aug 31, 2023, 1:53:11 PM
- Updated
- Oct 1, 2024, 5:51:21 PM
- EUVD base score (CVSS 3.1)
-
9.6 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N - EUVD-reported EPSS
- 0.0700
- Vendors
- Zscaler
- Products
-
ZIA Admin Portal (6.2 <6.2 (current))
- Aliases
-
GHSA-wfp5-6m78-crh3
ENISA description: An Improper Verification of Cryptographic Signature in the SAML authentication of the Zscaler Admin UI allows a Privilege Escalation.This issue affects Admin UI: from 6.2 before 6.2r.
EUVD references (1)
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Zscaler | ZIA Admin Portal |
6.2 (affected)
|
— |
Affected products — CPE 2.3 (1) NVD
NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.
cpe:2.3:a:zscaler:zscaler_internet_access_admin_portal:*:*:*:*:*:*:*:*
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
MITRE references (1) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (2)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://help.zscaler.com/zia/release-upgrade-summary-2023 cve@zscaler.com Release Notes
- https://help.zscaler.com/zia/release-upgrade-summary-2023 af854a3a-2127-422b-91ae-364da2661108 Release Notes
Indicators (1)
IOCs linked to the auto-promoted Threat row.
| Type | Value | VirusTotal | Attached |
|---|---|---|---|
| domain |
escalation.this
|
no local data | 2026-05-18 21:20 UTC |
Remediations (26)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:www.screwfix.com
Screwfix offers a wide range of trade tools and hardware at competitive prices with convenient delivery and collection options.
2026-06-10 17:34 UTC -
web:cve.armis.com
CVE-2023-28801 : A vulnerability in the SAML authentication process of the Zscaler Admin UI was discovered, classified as CWE-347 (Improper Verification of C...
2026-06-10 17:34 UTC -
web:www.patchplants.com
Patch helps you discover the best plants for your space, delivers them to your door and helps you look after them. Plants will turn your lounge into a living room.
2026-06-10 17:34 UTC -
web:www.sentinelone.com
CVE-2023-28801 is a privilege escalation vulnerability in Zscaler Internet Access Admin Portal. Learn about its impact, affected versions, and mitigation methods.
2026-06-10 17:34 UTC -
web:arcraiders.com
ARC Raiders is a multiplayer extraction adventure, set in a lethal future earth, ravaged by a mysterious mechanized threat known as ARC.
2026-06-10 17:34 UTC -
web:msrc.microsoft.com
Security Update Guide - Microsoft Security Response Center
2026-06-10 17:34 UTC -
web:www.strongboxit.com
Learn the key differences between vulnerability remediation vs mitigation in cybersecurity. Discover which method is effective for protecting your data.
2026-05-22 06:15 UTC -
web:jetpack.com
Which is more important? Explore cybersecurity threat mitigation vs. remediation . How to recover from a cyberattack & stop issues before they start.
2026-05-22 06:15 UTC -
web:panorays.com
Use Remediation When: If you have the time, expertise, and tools necessary to fully investigate the problem and apply a long-term fix , remediation is the best way to go. It's the only way to guarantee that the same problem won't arise to bite you further down the line, because mitigation is more of a temporary resolution. But it does require more resources, so it might not be a practical ...
2026-05-22 06:15 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-22 06:15 UTC -
web:securityboulevard.com
For cyber practitioners, the choice between mitigation and remediation often hinges on practical constraints. Immediate remediation might not be feasible due to operational dependencies or the potential impact on business continuity. In these scenarios, mitigation provides a valuable stopgap, offering protection while more permanent fixes are devised and deployed. What Are We Trying to ...
2026-05-22 06:15 UTC -
web:translate.google.com
Google's service, offered free of charge, instantly translates words, phrases, and web pages between English and over 100 other languages.
2026-05-22 06:15 UTC -
web:windowsreport.com
It's that time of the month again: Microsoft has rolled out its Patch Tuesday updates for Windows 11 versions 23H2, 22H2, and 21H2. Windows 11 23H2 and 22H2 users will see their systems updated through KB5041585, while those on 21H2 will receive KB5041592.
2026-05-22 06:15 UTC -
web:www.bugcrowd.com
Vulnerability mitigation is typically considered a temporary or interim solution. While mitigation measures can reduce the immediate risk associated with vulnerabilities, they may not provide a permanent fix . Organizations should aim to prioritize and plan for complete vulnerability remediation whenever feasible and allocate resources accordingly.
2026-05-22 06:15 UTC -
web:www.secure.com
Learn the difference between vulnerability remediation and mitigation , and how a risk-based strategy can strengthen your security posture.
2026-05-22 06:15 UTC -
web:www.securityweek.com
Microsoft has announced mitigations for CVE -2026-45585, a BitLocker bypass triggered via FsTx in Windows Recovery.
2026-05-22 06:15 UTC -
web:www.fda.gov
XD Investments LLC of Houston, TX, is voluntarily recalling approximately 448 Boxes of Better Weather Fix Elixir products, including all flavors and variations, because FDA analysis found the ...
2026-05-22 02:51 UTC -
web:www.fixtrading.org
Learn more Standards and Guidelines FIX standards have driven electronic trading for 30 years and are constantly updated to support industry needs Learn more Events and Community Our member-driven global educational and networking events bring the industry together Learn more
2026-05-22 02:51 UTC -
web:www.patchcareerinstitute.com
P.A.T.C.H . Career Institute's mission is to provide quality training to students in the medical and vocational field. Our primary focus is to provide affordable, and competitive educational training for low to moderate income students.
2026-05-22 02:51 UTC -
web:patch.moe
Age Verification Are you 18 years or older? YES NO
2026-05-22 02:51 UTC -
web:patch.com
The best breaking news, stories, and events from the Patch network of local news sites
2026-05-22 02:51 UTC -
web:www.romhacking.net
Add temporary header() Patch file: Apply patch Original ROM: Modified ROM: Patch type: IPS BPS PPF UPS APS RUP Create patch Settings Rom Patcher JS v2.9 by Marc Robledo See on GitHub Donate Language English Français Deutsch Italiano Español Nederlands Svenska Català Valencià Português Brasileiro Russian 日本語 中文（简体） 中文 ...
2026-05-22 02:51 UTC -
web:nvd.nist.gov
The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...
2026-05-22 02:51 UTC -
web:epatch.pa.gov
Why does PATCH exist? Its purpose is to better enable the public to obtain criminal history record checks. The repository was created and is maintained in accordance with Pennsylvania's Criminal History Information Act contained in Chapter 91 of Title 18, Crimes Code. This Act also directs the Pennsylvania State Police (PSP) to disseminate criminal history data to criminal justice agencies ...
2026-05-22 02:51 UTC -
web:blog.qualys.com
RedSun is a zero-day LPE in Microsoft Defender with no patch available. Learn how to detect and mitigate it instantly using Qualys VMDR and TruRisk™ Eliminate.
2026-05-22 02:51 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-05-22 02:51 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2023-28801.json.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T13:51:38.296Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://help.zscaler.com/zia/release-upgrade-summary-2023"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-28801",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-01T17:51:04.398078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-01T17:51:21.271Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ZIA Admin Portal",
"vendor": "Zscaler",
"versions": [
{
"lessThan": "6.2 (current)",
"status": "affected",
"version": "6.2",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Improper Verification of Cryptographic Signature in the SAML authentication of the Zscaler Admin UI allows a Privilege Escalation.This issue affects Admin UI: from 6.2 before 6.2r.\n\n"
}
],
"value": "An Improper Verification of Cryptographic Signature in the SAML authentication of the Zscaler Admin UI allows a Privilege Escalation.This issue affects Admin UI: from 6.2 before 6.2r.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-31T13:53:27.304Z",
"orgId": "73c6f63b-efac-410d-a0a9-569700f85a04",
"shortName": "Zscaler"
},
"references": [
{
"url": "https://help.zscaler.com/zia/release-upgrade-summary-2023"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Improper SAML signature verification",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "73c6f63b-efac-410d-a0a9-569700f85a04",
"assignerShortName": "Zscaler",
"cveId": "CVE-2023-28801",
"datePublished": "2023-08-31T13:53:11.266Z",
"dateReserved": "2023-03-23T18:29:15.803Z",
"dateUpdated": "2024-10-01T17:51:21.271Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}