Critical severity · published Aug 24, 2026
CVE-2026-59568
Remote Code Execution
9.1
CVSS
0.7%
EPSS
No
On KEV
Description
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Client Connector · Zscaler
before Windows: 4.6.0.457, 4.7.0.317, 4.8.0.232, 4.9.0.372; before MacOS: 4.5.2.312, 4.7.0.292, 4.8.0.191; before Linux: 3.7.2.64, 4.2.1.64; before Android: 4.2; before ChromeOS: 4.2; before iOS: 4.5.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59568
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59568
help.zscaler.com
https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2026
More from Client Connector
9.8
CVE-2024-23483
Local Privilege Escalation via lack of input validation
9.8
CVE-2024-23459
Multiple Arbitrary Creates/Overwrites by link following
9.8
CVE-2023-28798
Out-of-bounds write to heap in pacparser
9.8
CVE-2024-23480
Insecure MacOS code sign check fallback
9.8
CVE-2023-28805
ZCC on Linux privilege escalation