Skip to main content

Client Connector EUVDEUVD-2026-77537

| CVE-2026-59569 HIGH
Improper Input Validation (CWE-20)
2026-09-14 Zscaler GHSA-4vcv-p436-xxwh
Authentication Bypass Google Client Connector
8.1
CVSS 3.1 · Vendor: Zscaler
Share

Severity by source

Vendor (Zscaler) PRIMARY
8.1 HIGH
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

Primary rating from Vendor (Zscaler) · only source for this CVE.

CVSS VectorVendor: Zscaler

Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Sep 15, 2026 - 11:32 vuln.today
CVE Published
Sep 14, 2026 - 14:42 cve.org
HIGH 8.1

DescriptionCVE.org

An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls.

AnalysisAI

Improper input validation in Zscaler Client Connector for Android and ChromeOS (builds prior to 4.2.0.152) lets an attacker with elevated local privileges on the endpoint feed malformed input to the connector and bypass Zscaler's traffic inspection and access controls, with a CVSS 8.1 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L) rating that reflects total loss of the security control's integrity. The flaw is not remotely exploitable and requires high privileges (root or equivalent device-admin context) on the affected Android or ChromeOS device, and there is no public exploit identified at time of analysis. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Client Connector

View all
CVE-2024-3661 HIGH POC
7.6 May 06

DHCP can add routes to a client’s routing table via the classless static route option (121). Rated high severity (CVSS 7
CVE-2024-23483 CRITICAL
9.8 Aug 06

An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection.2. Rated cri
CVE-2024-23459 CRITICAL
9.8 May 02

An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allow
CVE-2024-23480 CRITICAL
9.8 May 01

A fallback mechanism in code sign checking on macOS may allow arbitrary code execution.2. Rated critical severity (CVSS

CVE-2023-28805 CRITICAL
9.8 Oct 23

An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation.4.0.105. Rat
CVE-2026-59568 CRITICAL
9.1 Aug 24

Remote code execution in Zscaler Client Connector (ZCC) lets a remote, unauthenticated attacker run arbitrary code withi
CVE-2026-59564 CRITICAL
9.1 Aug 24

Authentication bypass in Zscaler Client Connector allows remote unauthenticated attackers to subvert the trust between t
CVE-2026-59565 HIGH
8.8 Aug 24

Remote buffer overflow in Zscaler Client Connector on Windows enables a network-accessible attacker with low privileges

CVE-2026-59567 HIGH
8.8 Aug 24

Local privilege escalation in Zscaler Client Connector enables a standard (non-administrative) local user to execute arb
CVE-2026-59566 HIGH
8.4 Aug 24

Buffer overflow in Zscaler Client Connector on Android and ChromeOS allows local exploitation to trigger a denial-of-ser
CVE-2026-25687 HIGH
8.1 Sep 14

We need to produce a JSON object with the specified fields. Let me synthesize. CVE-2026-25687: race condition in ZPA tu
CVE-2024-23463 HIGH
8.1 Apr 30

Anti-tampering protection of the Zscaler Client Connector can be bypassed under certain conditions when running the Repa

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-77537 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy