Zscaler Client Connector CVE-2026-59564

The vulnerable interaction is the authenticated communication channel between the Zscaler Client Connector agent and the Zscaler Client Connector Portal; exploitation requires network reach to that channel and a connector running a version below the per-platform fix level (e.g., Windows < 4.6.0.457/4.7.0.317/4.8.0.232/4.9.0.372, macOS < 4.5.2.312/4.7.0.292/4.8.0.191, Linux < 3.7.2.64/4.2.1.64, iOS < 4.5.1, Android < 4.2, ChromeOS < 4.2). Per CVSS (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required; the main limiting factor is the attacker's ability to reach or position on the connector-portal communication path, and the vendor description's emphasis on 'communications between' the two components suggests network positioning may be the practical constraint rather than any special agent configuration.

The signals point to a serious, high-priority issue: CVSS 9.1 with AV:N, AC:L, PR:N, and UI:N describes network-reachable, low-complexity, unauthenticated exploitation, and CWE-304 authentication bypasses are frequently reliable once understood. Confidentiality and integrity impacts are High while availability is None, consistent with data/trust compromise rather than disruption. No EPSS score, POC, or CISA KEV entry was provided, so probability-of-exploitation and active-exploitation signals are absent - the score is a theoretical-severity read, not evidence of in-the-wild use, and organizations should treat this as urgent to patch even though widespread exploitation is unconfirmed. One caveat worth verifying with the vendor: the description frames this as a flaw in 'communications between' the connector and its portal, which could imply a man-in-the-middle or portal-side precondition, whereas the AV:N/PR:N vector implies fully remote unauthenticated reach - reconcile this before deprioritizing based on assumed network positioning requirements.

A remote attacker who can reach the connector-to-portal communication path abuses the missing authentication step to impersonate a trusted party, obtaining sensitive configuration/policy data or injecting attacker-controlled settings without valid credentials (CVSS PR:N, UI:N). No public proof-of-concept is known, but the low attack complexity means a working exploit could be developed once the authentication gap is understood.