Zscaler Client Connector — the endpoint agent that brokers Zero Trust/SASE connectivity for Zscaler Internet Access and Private Access — shipped five CVEs in the same 2026 release train, disclosed via Zscaler's Client Connector App Release Summary 2026 and published to NVD on 2026-08-24.

CVE-2026-59568 is the headline issue: an improper-input-validation flaw (CWE-20) that allows an unauthenticated, unprivileged attacker to execute arbitrary code within the Client Connector's own process context (CVSS 3.1 9.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). NVD's description frames it as 'multiple vulnerabilities' rather than a single bug, indicating more than one distinct code path reaches the unvalidated-input condition.

CVE-2026-59564 is a CWE-304 (Missing Critical Step in Authentication) issue in the communications channel between the Client Connector app and its backend Client Connector Portal, also scored 9.1 with an identical vector — meaning an attacker on the network path between agent and portal can bypass an authentication step in that protocol.

CVE-2026-59567 is a set of local privilege-escalation bugs (CWE-280, Improper Handling of Insufficient Permissions or Privileges, CVSS 8.8: AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) letting an unprivileged local user reach arbitrary code execution in a privileged context; the Scope:Changed (S:C) vector confirms the exploited component's privileges extend beyond its own security scope.

CVE-2026-59565 is a remotely reachable buffer overflow (CWE-229, Improper Handling of Values, CVSS 8.8: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) that crashes the Windows kernel/driver component, producing a local and kernel denial-of-service condition.

Fixed builds were published across Windows, macOS, Linux, Android, ChromeOS, and iOS on 2026-06-01, roughly 12 weeks before the CVEs were assigned and publicized; GBHackers additionally cites a further round of Windows hardening builds (4.9.0.455, 4.8.0.291, 4.9.0.448, 4.8.0.284, 4.7.0.364) beyond the initial June baseline. As of the 2026-08-25 GBHackers report, no public proof-of-concept, technical exploit writeup, or exploitation-in-the-wild has surfaced, and this research found no additional public PoC or KEV listing. Because Client Connector is a widely deployed enterprise security/VPN agent that typically runs with elevated (SYSTEM/service) privileges, unpatched fleets remain a high-value target: compromising the agent itself both grants code execution on the endpoint and can undermine the security control the agent is meant to provide.

A fifth vulnerability in the same release train, CVE-2026-59566 (CVSS 3.1: 8.4, AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-229), was published alongside the other four on 2026-08-24: a locally exploitable buffer overflow causing a local denial-of-service on Android and ChromeOS builds prior to 4.2, sharing the same weakness class (Improper Handling of Values) as the Windows kernel DoS in CVE-2026-59565. Together the five CVEs span every platform Client Connector ships on (Windows, macOS, Linux, Android, ChromeOS, iOS) and give this release train an average disclosed CVSS in the high-8s/low-9s range — a marked jump from an earlier, unrelated 2026 Client Connector issue this research also located (CVE-2026-22569, CVSS 5.4, published 2026-03-31), where an incorrect startup configuration on Windows could leave a limited amount of traffic uninspected under rare circumstances. Tenable's legacy CVSSv2 scoring for CVE-2026-59568 (9.4, AV:N/AC:L/Au:N/C:C/I:C/A:N) corroborates the same complete-confidentiality/integrity-compromise characterization as the v3.1 score.

Two evidence-bound technical inferences follow from the published CVSS vectors even though Zscaler has not disclosed the vulnerable component, listening port, or protocol for any of the five CVEs. First, CVE-2026-59565's vector carries PR:L despite an AV:N (network) attack vector — meaning, per Tenable's own phrasing, the flaw requires an 'authenticated remote attacker,' i.e. someone who already holds some low-privilege network-reachable session, rather than a fully anonymous outsider. Second, that same vector scores C:H/I:H/A:H — full impact across all three properties, not an availability-only DoS — even though both Zscaler's own text and NVD categorize it only as a 'local and kernel denial-of-service.' A kernel/driver-context buffer overflow that corrupts memory can plausibly do more than crash the system; the full-impact scoring leaves that door open even though no source confirms code execution beyond the documented crash. Third, CVE-2026-59564's flaw sits specifically 'in communications between' the Client Connector app and its backend Portal (CWE-304) — architecturally, exploiting a gap in that channel favors an attacker positioned on the network path between agent and portal, which is why this research maps an Adversary-in-the-Middle technique alongside the direct authentication-bypass mapping for that CVE.

No source located during this research — GBHackers, NVD, Tenable, MITRE's CVE.org record, or public exploit trackers (GitHub PoC collections, Exploit-DB-style search) — describes a public proof-of-concept, a technical write-up of the exploitation sequence, or confirmed exploitation in the wild for any of the five CVEs; Zscaler's own advisory text is limited to the one-line CWE-mapped description and the remediated build numbers per platform.