Zscaler Client Connector CVE-2026-59567

Exploitation requires an authenticated local user session on the target endpoint - specifically a non-administrative OS account, consistent with CVSS PR:L. The attack vector is strictly local (AV:L), meaning remote unauthenticated exploitation is not applicable; an attacker without an existing endpoint foothold cannot trigger this vulnerability. The Zscaler Client Connector agent must be installed and running in its privileged context, which is the standard deployment posture for any Zscaler ZTNA customer endpoint. No additional non-default configuration is described as required beyond the agent's normal operation. Exploitation is concretely limited by two factors: (1) the attacker must possess a valid local user session on the specific endpoint, eliminating purely remote threat actors; and (2) Zscaler Client Connector must be present, restricting the attack surface to managed enterprise endpoints within Zscaler deployments. No user interaction beyond the attacker's own session is required.

The CVSS 3.1 base score of 8.8 is driven primarily by the scope change (S:C) and the full confidentiality, integrity, and availability impact triad at High, meaning successful exploitation fully compromises the privileged Zscaler agent component. Attack vector is Local (AV:L) and requires low privileges (PR:L), which materially limits who can exploit this: an attacker must already have a standard user session on the target endpoint. No elevated complexity (AC:L) or user interaction (UI:N) is required beyond that foothold. No EPSS score was provided in the available data, no CISA KEV listing exists, and no confirmed public exploit code has been identified - all of which temper urgency relative to the raw score. However, Zscaler Client Connector's endpoint deployment posture makes this a meaningful post-compromise escalation path on corporate workstations, particularly where attackers achieve initial access via phishing or malicious document delivery under a standard user account. The CPE wildcard version prevents precise scoping without consulting the vendor advisory directly.

An attacker who has obtained a standard user session on a corporate endpoint - for example, through a phishing email delivering a document-based dropper - leverages one of the CWE-280 flaws in the locally running Zscaler Client Connector agent to escalate privileges into the agent's privileged process context. From that elevated position, the attacker can execute arbitrary code with high-level OS privileges, enabling credential harvesting, persistence mechanisms, or lateral movement across the network. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) indicates exploitation does not require sophisticated tooling once the specific privilege boundary flaw is understood.