Zscaler Fixes Multiple Critical Flaws in Client Connector Enabling RCE and Authentication Bypass
Zscaler has released patches for several vulnerabilities in its Client Connector agent that could lead to remote code execution, authentication bypass, local privilege escalation, and denial of service. The most severe issue, tracked as CVE-2026-59568 with a CVSS score of 9.1, allows unauthenticated remote attackers to execute arbitrary code within the context of the Zscaler Client Connector process. A second critical flaw, CVE-2026-59564 also rated CVSS 9.1, affects communication between the connector and its management portal, enabling attackers to circumvent authentication mechanisms. Additional vulnerabilities include a local buffer overflow on Android and ChromeOS tracked as CVE-2026-59566 with CVSS 8.4, as well as issues that could result in privilege escalation or service disruption. The flaws impact Client Connector versions across Windows, macOS, Linux, iOS, Android, and ChromeOS, with varying affected builds depending on the platform. Updated builds for lines 4.6 through 4.9 on Windows and equivalent fixes for other operating systems are now available.
BoletimSecAug 26, 2026Translated from Portuguese