Zscaler Client Connector CVE-2026-59566

Exploitation requires local code execution on the target Android or ChromeOS device - the attacker must be able to run code in the same operating environment as the Zscaler Client Connector. The CVSS vector specifies PR:N, meaning no elevated privileges are required for the local trigger, so a normal user-level process or app on the device is sufficient. The vulnerability is platform-scoped to Android and ChromeOS; other Zscaler Client Connector platforms (Windows, macOS, iOS, Linux) are not referenced in the advisory. No special configuration of the connector itself is identified as a prerequisite. Exploitation is limited by the requirement for prior local access - remote unauthenticated exploitation from the network is not indicated by the AV:L vector.

The raw CVSS score of 8.4 overstates realistic impact relative to what the description confirms: vendor language describes local DoS only, yet the vector carries C:H/I:H/A:H, implying full compromise potential. This discrepancy is unresolved from available data - it may reflect vendor-internal knowledge of potential code execution that the public description omits, or it may be a scoring error. EPSS data is not provided in the input, and KEV status is absent, meaning exploitation probability and confirmed active exploitation cannot be assessed. There is no public proof-of-concept identified at time of analysis. The attack vector is local (AV:L), limiting exposure to scenarios where an attacker already has user-level access to the Android or ChromeOS device, which substantially reduces the realistic threat surface compared to a network-exploitable flaw. The absence of required privileges (PR:N) for a local bug is notable - it suggests any process or app running on the device could potentially trigger the overflow without elevated permissions. For enterprise fleets where Zscaler Client Connector is a perimeter-security control, disruption of the connector could degrade network segmentation enforcement, elevating the strategic risk beyond a simple application crash.

An attacker who has already obtained user-level code execution on a target Android or ChromeOS device - for example, via a malicious application side-loaded by the user - crafts input that triggers the buffer overflow in the Zscaler Client Connector process. The overflow crashes the connector, severing the device's ZTNA tunnel and potentially bypassing network access controls enforced by the connector during the outage. No public proof-of-concept exists at time of analysis, so this scenario remains theoretical.