Read the docs
TI-2026-42526 Aliases CVE-2026-59564GHSA-r7wr-wrcm-fj8q

Authentication bypass between ZCC and client connector portal

Priority MEDIUM 48CWE-304Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00529 44th percentileScored 2026-11-07
Fix Fixed Client Connector (Zscaler): Windows: 4.6.0.457, 4.7.0.317, 4.8.0.232 +9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZscalerClient Connectorbefore Windows: 4.6.0.457, 4.7.0.317, 4.8.0.232, 4.9.0.372; before MacOS: 4.5.2.312, 4.7.0.292, 4.8.0.191; before iOS: 4.5.1; before Android: 4.2; before ChromeOS: 4.2; before Linux: 3.7.2.64, 4.2.1.64Windows: 4.6.0.457, 4.7.0.317, 4.8.0.232, 4.9.0.372, MacOS: 4.5.2.312, 4.7.0.292, 4.8.0.191, iOS: 4.5.1, Android: 4.2, ChromeOS: 4.2, Linux: 3.7.2.64, 4.2.1.64Patch availableCNA
  • Client Connector VendorZscaler Affected before Windows: 4.6.0.457, 4.7.0.317, 4.8.0.232, 4.9.0.372; before MacOS: 4.5.2.312, 4.7.0.292, 4.8.0.191; before iOS: 4.5.1; before Android: 4.2; before ChromeOS: 4.2; before Linux: 3.7.2.64, 4.2.1.64 Fixed in Windows: 4.6.0.457, 4.7.0.317, 4.8.0.232, 4.9.0.372, MacOS: 4.5.2.312, 4.7.0.292, 4.8.0.191, iOS: 4.5.1, Android: 4.2, ChromeOS: 4.2, Linux: 3.7.2.64, 4.2.1.64 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:*:*:*——Zscaler
  • cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:*:*:* Versions — — ·Zscaler

Remediation

  • Fix · CNA Client Connector (Zscaler) Fixed in Windows: 4.6.0.457, 4.7.0.317, 4.8.0.232, 4.9.0.372, MacOS: 4.5.2.312, 4.7.0.292, 4.8.0.191, iOS: 4.5.1, Android: 4.2, ChromeOS: 4.2, Linux: 3.7.2.64, 4.2.1.64

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Zscaler Client Connector Android: 4.2, ChromeOS: 4.2 and 4 more versions

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-42530 Remote code execution in Zscaler Client ConnectorPriority MEDIUM 48
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59564
  2. 2026-10-03 Alias added: GHSA-r7wr-wrcm-fj8q

References

Other 1

  • TI-2023-22133 Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local… CVSS 3.1MEDIUM 5.5
  • TI-2026-42530 Remote code execution in Zscaler Client Connector CVSS 3.1CRITICAL 9.1
  • TI-2020-09334 The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer… CVSS 3.1CRITICAL 9.8
  • TI-2024-15528 Local Privilege Escalation via lack of input validation CVSS 3.1CRITICAL 9.8
  • TI-2025-34691 SAML 2.0 Public Key Validation Issue CVSS 3.1CRITICAL 9.6
  • TI-2024-15526 Insecure MacOS code sign check fallback CVSS 3.1CRITICAL 9.8
See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences