# Multiple Zscaler Client Connector Flaws Enable Remote Code Execution (CVE-2026-59568)

> Zscaler patched five vulnerabilities in Client Connector in its June 1, 2026 release train, headlined by CVE-2026-59568 (CVSS 9.1, CWE-20), which lets an unauthenticated, unprivileged attacker execute arbitrary code in the product's context with no user interaction. The same release also fixes an authentication bypass between the client and the Client Connector Portal (CVE-2026-59564, CVSS 9.1), a local privilege-escalation flaw (CVE-2026-59567, CVSS 8.8), a Windows local/kernel denial-of-service buffer overflow (CVE-2026-59565, CVSS 8.8), and an Android/ChromeOS local denial-of-service buffer overflow (CVE-2026-59566, CVSS 8.4).

- **Published:** 2026-08-25T00:00:00Z
- **Last reviewed:** 2026-08-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2139
- **ID:** TL-2026-2139
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-59568, CVE-2026-59564, CVE-2026-59567, CVE-2026-59565, CVE-2026-59566, CVE-2026-22569

## Description

Zscaler Client Connector — the endpoint agent that brokers Zero Trust/SASE connectivity for Zscaler Internet Access and Private Access — shipped five CVEs in the same 2026 release train, disclosed via Zscaler's Client Connector App Release Summary 2026 and published to NVD on 2026-08-24.

CVE-2026-59568 is the headline issue: an improper-input-validation flaw (CWE-20) that allows an unauthenticated, unprivileged attacker to execute arbitrary code within the Client Connector's own process context (CVSS 3.1 9.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). NVD's description frames it as 'multiple vulnerabilities' rather than a single bug, indicating more than one distinct code path reaches the unvalidated-input condition.

CVE-2026-59564 is a CWE-304 (Missing Critical Step in Authentication) issue in the communications channel between the Client Connector app and its backend Client Connector Portal, also scored 9.1 with an identical vector — meaning an attacker on the network path between agent and portal can bypass an authentication step in that protocol.

CVE-2026-59567 is a set of local privilege-escalation bugs (CWE-280, Improper Handling of Insufficient Permissions or Privileges, CVSS 8.8: AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) letting an unprivileged local user reach arbitrary code execution in a privileged context; the Scope:Changed (S:C) vector confirms the exploited component's privileges extend beyond its own security scope.

CVE-2026-59565 is a remotely reachable buffer overflow (CWE-229, Improper Handling of Values, CVSS 8.8: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) that crashes the Windows kernel/driver component, producing a local and kernel denial-of-service condition.

Fixed builds were published across Windows, macOS, Linux, Android, ChromeOS, and iOS on 2026-06-01, roughly 12 weeks before the CVEs were assigned and publicized; GBHackers additionally cites a further round of Windows hardening builds (4.9.0.455, 4.8.0.291, 4.9.0.448, 4.8.0.284, 4.7.0.364) beyond the initial June baseline. As of the 2026-08-25 GBHackers report, no public proof-of-concept, technical exploit writeup, or exploitation-in-the-wild has surfaced, and this research found no additional public PoC or KEV listing. Because Client Connector is a widely deployed enterprise security/VPN agent that typically runs with elevated (SYSTEM/service) privileges, unpatched fleets remain a high-value target: compromising the agent itself both grants code execution on the endpoint and can undermine the security control the agent is meant to provide.

A fifth vulnerability in the same release train, CVE-2026-59566 (CVSS 3.1: 8.4, AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-229), was published alongside the other four on 2026-08-24: a locally exploitable buffer overflow causing a local denial-of-service on Android and ChromeOS builds prior to 4.2, sharing the same weakness class (Improper Handling of Values) as the Windows kernel DoS in CVE-2026-59565. Together the five CVEs span every platform Client Connector ships on (Windows, macOS, Linux, Android, ChromeOS, iOS) and give this release train an average disclosed CVSS in the high-8s/low-9s range — a marked jump from an earlier, unrelated 2026 Client Connector issue this research also located (CVE-2026-22569, CVSS 5.4, published 2026-03-31), where an incorrect startup configuration on Windows could leave a limited amount of traffic uninspected under rare circumstances. Tenable's legacy CVSSv2 scoring for CVE-2026-59568 (9.4, AV:N/AC:L/Au:N/C:C/I:C/A:N) corroborates the same complete-confidentiality/integrity-compromise characterization as the v3.1 score.

Two evidence-bound technical inferences follow from the published CVSS vectors even though Zscaler has not disclosed the vulnerable component, listening port, or protocol for any of the five CVEs. First, CVE-2026-59565's vector carries PR:L despite an AV:N (network) attack vector — meaning, per Tenable's own phrasing, the flaw requires an 'authenticated remote attacker,' i.e. someone who already holds some low-privilege network-reachable session, rather than a fully anonymous outsider. Second, that same vector scores C:H/I:H/A:H — full impact across all three properties, not an availability-only DoS — even though both Zscaler's own text and NVD categorize it only as a 'local and kernel denial-of-service.' A kernel/driver-context buffer overflow that corrupts memory can plausibly do more than crash the system; the full-impact scoring leaves that door open even though no source confirms code execution beyond the documented crash. Third, CVE-2026-59564's flaw sits specifically 'in communications between' the Client Connector app and its backend Portal (CWE-304) — architecturally, exploiting a gap in that channel favors an attacker positioned on the network path between agent and portal, which is why this research maps an Adversary-in-the-Middle technique alongside the direct authentication-bypass mapping for that CVE.

No source located during this research — GBHackers, NVD, Tenable, MITRE's CVE.org record, or public exploit trackers (GitHub PoC collections, Exploit-DB-style search) — describes a public proof-of-concept, a technical write-up of the exploitation sequence, or confirmed exploitation in the wild for any of the five CVEs; Zscaler's own advisory text is limited to the one-line CWE-mapped description and the remediated build numbers per platform.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.006 Vulnerabilities
- T1588.005 Exploits
- T1203 Exploitation for Client Execution
- T1557 Adversary-in-the-Middle
- T1556 Modify Authentication Process
- T1499.004 Application or System Exploitation
- T1489 Service Stop

## Sources

- [Multiple Zscaler Client Connector Flaws Enable Remote Code Execution](https://gbhackers.com/multiple-zscaler-client-connector-flaws/)
- [NVD - CVE-2026-59568](https://nvd.nist.gov/vuln/detail/CVE-2026-59568)
- [NVD - CVE-2026-59564](https://nvd.nist.gov/vuln/detail/CVE-2026-59564)
- [NVD - CVE-2026-59567](https://nvd.nist.gov/vuln/detail/CVE-2026-59567)
- [NVD - CVE-2026-59565](https://nvd.nist.gov/vuln/detail/CVE-2026-59565)
- [NVD - CVE-2026-59566](https://nvd.nist.gov/vuln/detail/CVE-2026-59566)
- [CVE-2026-59568 | Tenable](https://www.tenable.com/cve/CVE-2026-59568)
- [Zscaler Client Connector App Release Summary 2026](https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2026)
- [Zscaler Client Connector Security Vulnerabilities in 2026 (incl. CVE-2026-59566, CVE-2026-22569)](https://stack.watch/product/zscaler/client-connector/)
- [CVE-2026-59568 | CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-59568)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2139