Zscaler Client Connector CVE-2026-59568

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, elevated privileges, or user interaction is required, and the description explicitly states an unauthenticated, unprivileged user can trigger it - the prerequisite is network reachability to a device running an affected version of Zscaler Client Connector. What limits exploitation is that the target must be running a vulnerable ZCC build (versions fixed in the 2026 release summary are not affected) and the attacker must be able to reach the agent's exposed input path; the exact feature, port, or protocol that must be reachable is not specified in the available data and should be confirmed with Zscaler. Code execution is confined to the ZCC process context rather than automatically SYSTEM/root, which is a meaningful bound on immediate impact.

The signals point to a genuinely high-priority issue but with important gaps. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated, no-interaction path yielding high confidentiality and integrity impact - the profile of a serious RCE, and organizations should treat it as urgent given how broadly ZCC is deployed across managed fleets. However, several corroborating signals are absent: no EPSS score is provided, the issue is not in CISA KEV (no confirmed active exploitation), and no public POC is referenced, so the 9.1 reflects potential severity rather than demonstrated in-the-wild use. One internal inconsistency to verify: the vector sets A:N (no availability impact) yet the description asserts arbitrary code execution, which normally implies availability impact as well - the scope and reachability of the 'RCE' should be confirmed with Zscaler. Bottom line: prioritize patching because of the unauthenticated network RCE profile and wide install base, while recognizing that exploitation-probability evidence (EPSS/KEV/POC) is currently missing rather than reassuring.

A remote attacker able to reach a target endpoint's ZCC agent sends crafted, malformed input to a vulnerable handler that fails to validate it properly, causing arbitrary code to execute within the ZCC process without any authentication or user interaction. Given AC:L, the trigger is reliable once reachable; no public POC is currently identified, so an attacker would need to reverse-engineer the fixed vs. vulnerable builds to weaponize it.