CVE Intelligence
Analysis AI-assisted

CVE-2026-59568: Zscaler Client Connector Remote Code Execution

CVE-2026-59568 affects Zscaler Client Connector and, according to the record, allows an unauthenticated, unprivileged user to run arbitrary code in the ZCC context. The record rates it 9.1 (Critical) and lists affected builds per platform, but it has no fixed-version field. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Zscaler published CVE-2026-59568 for Zscaler Client Connector (ZCC). The record describes multiple vulnerabilities in affected versions that allow remote code execution by an unauthenticated, unprivileged user, who could run arbitrary code in the ZCC context. The record classifies the weakness as CWE-20, Improper Input Validation.

Impact

  • The record assigns a CVSS score of 9.1 (Critical) with a network attack vector, low complexity, no privileges required and no user interaction.
  • The record marks confidentiality and integrity impact as high and availability impact as none.
  • The SSVC data in the record lists the issue as automatable (yes) with total technical impact.
  • The practical consequences on a given endpoint depend on the privileges ZCC runs with, which the record does not state.

Affected products and versions

The record lists only Zscaler Client Connector. It marks the following builds per platform as affected below the stated values:

  • Windows: 4.6.0.457, 4.7.0.317, 4.8.0.232, 4.9.0.372
  • MacOS: 4.5.2.312, 4.7.0.292, 4.8.0.191
  • Linux: 3.7.2.64, 4.2.1.64
  • Android: 4.2
  • ChromeOS: 4.2
  • iOS: 4.5.1

The fixes field in the record is empty. The values above are likely the first builds without the issue, but the record does not confirm this, so treat that reading as an inference and check the vendor release summary.

Exploitation status

The record does not show this CVE in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00664 with a percentile of 0.51175. The SSVC exploitation value is recorded as none.

Remediation and mitigation

  • Identify all ZCC installations and their versions on Windows, macOS, Linux, Android, ChromeOS and iOS.
  • Compare each installed build with the vendor release summary and upgrade to a build the vendor identifies as unaffected.
  • Prioritise endpoints where ZCC runs with elevated privileges or processes untrusted input, and follow vendor guidance for any interim measures.

Detection guidance

  • Keep an inventory of ZCC versions and flag builds at or below the listed boundary values.
  • Monitor endpoint telemetry for unexpected child processes or unusual behaviour from the ZCC process, and review application logs for crashes or anomalous input handling.
  • Treat these signals as indicators to investigate, not as proof of compromise.

Limitations of the available information

The record is awaiting analysis and gives a short, generic description that does not name the individual vulnerabilities. No technical details or proof-of-concept information are provided, and the record has no fixed-version field. The vendor release summary is the only reference listed.

Frequently asked questions

Does CVE-2026-59568 require authentication to exploit?

According to the record, the issue can be triggered by an unauthenticated, unprivileged user, which is why it is rated critical. The record does not describe the exact conditions needed.

Is there a fixed version for this issue?

The record has an empty fixes field, so it does not state fixed versions. The vendor release summary is the reference to check for the builds that address the issue.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.