by Kastro
Paper/Archive/CVE-2026-59568

CVE-2026-59568

Zscaler Client Connector — Remote Code Execution

EPSS 0.7%CVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 51.8.518 × 2010.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context.

Affected

ProductAffectedFixed inSource
Client Connector< Windows: 4.6.0.457, 4.7.0.317, 4.8.0.232, 4.9.0.372Windows: 4.6.0.457, 4.7.0.317, 4.8.0.232, 4.9.0.372CNA
Client Connector< MacOS: 4.5.2.312, 4.7.0.292, 4.8.0.191MacOS: 4.5.2.312, 4.7.0.292, 4.8.0.191CNA
Client Connector< Linux: 3.7.2.64, 4.2.1.64Linux: 3.7.2.64, 4.2.1.64CNA
Client Connector< Android: 4.2Android: 4.2CNA
Client Connector< ChromeOS: 4.2ChromeOS: 4.2CNA
Client Connector< iOS: 4.5.1iOS: 4.5.1CNA

Scores by source

Zscaler (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refhelp.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2026