A critical vulnerability in its Client Connector endpoint application that could allow an unauthenticated attacker to execute arbitrary code without requiring user interaction or valid login credentials.
Tracked as CVE-2026-59568, the flaw has received a CVSS v3.1 score of 9.1 and is classified as Critical.
The vulnerability is remotely exploitable over a network and requires neither privileges nor user interaction, creating a potentially severe exposure for enterprises that use Zscaler Client Connector on managed Windows endpoints.
The vulnerability carries the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating that exploitation requires low attack complexity and can be initiated through network access.
Critical Zscaler Client Connector Vulnerability
A successful attack could enable high-impact compromise of confidentiality and integrity, although the advisory does not identify an availability impact.
Zscaler’s 2026 Client Connector release summary indicates that CVE-2026-59568 addresses multiple remote code execution vulnerabilities rather than a single isolated flaw.
This lack of public exploit information means defenders currently have limited options for developing reliable network-based detection signatures or indicators of compromise.
Zscaler included fixes for the RCE vulnerabilities in Client Connector releases published on June 1, 2026. For Windows systems, version 4.8.0.232 is identified as mitigating the multiple RCE issues associated with CVE-2026-59568.
Later Windows builds listed in Zscaler’s 2026 release documentation include 4.9.0.455, 4.8.0.291, 4.9.0.448, 4.8.0.284, and 4.7.0.364.
The same release cycle also addresses CVE-2026-59564, an authentication bypass vulnerability; CVE-2026-59567, covering multiple local privilege escalation issues; and CVE-2026-59565, a local and kernel denial-of-service flaw.
The risk is significant because Client Connector is commonly used in Zscaler Internet Access and Zscaler Private Access deployments. Endpoint connectivity agents can support proxying, tunneling, traffic inspection, posture checks, and security policy enforcement.
Code execution within the connector’s process context could provide attackers with an initial foothold on a managed endpoint, potentially enabling credential theft, tampering with security controls, reconnaissance, lateral movement, or data collection.
Administrators should immediately inventory endpoints running Zscaler Client Connector and verify the installed versions against the vendor’s remediation guidance. Organizations should not assume an endpoint is protected merely because it receives software through an existing device-management policy.
Security teams should also review endpoint telemetry for suspicious child processes spawned by Zscaler components, unexpected listening services, anomalous outbound connections, service changes, and failed update attempts.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
