Zscaler has addressed multiple vulnerabilities in its Client Connector that could allow remote code execution, authentication bypass, privilege escalation, and denial of service.
The most critical issue, identified as CVE-2026-59568 and rated CVSS 9.1, combines several weaknesses that can be exploited remotely by an unauthenticated attacker without prior privileges. Successful exploitation grants the ability to run arbitrary code inside the Zscaler Client Connector process, potentially enabling malware installation, configuration changes, data theft, or further compromise of the affected device.
Another high-severity flaw, CVE-2026-59564, also scored CVSS 9.1, impacts the communication channel between the Client Connector and its management portal. This vulnerability permits attackers to bypass authentication controls and gain unauthorized access to management functions.
The advisory further covers local privilege escalation issues and conditions that may trigger denial of service. On Android and ChromeOS, CVE-2026-59566 (CVSS 8.4) involves a locally exploitable buffer overflow.
Affected platforms include Windows, macOS, Linux, iOS, Android, and ChromeOS, although the precise vulnerable builds differ by operating system. Zscaler has published corrected versions covering the 4.6, 4.7, 4.8, and 4.9 release lines on Windows along with corresponding updates for the remaining platforms.
