« Back to list

CVE-2026-59564

Status: Awaiting AnalysisCritical (9.1)—

An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

AV:N/PR:N/UI:N indica explotación remota sin privilegios ni interacción (T1190). CWE-304 (authentication bypass) permite acceso no autorizado a cuentas o sesiones (T1078.001), con posible creación/modificación de cuentas de servicio (T1098.002).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Privileged Account ManagementMulti-factor AuthenticationVulnerability ScanningPassword PoliciesNetwork SegmentationLimit Access to Resource Over Network

Affected technologies (2)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Zscaler — Client ConnectorAIZscaler — Client Connector PortalAI

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-59564",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59564",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-24T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@zscaler.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@zscaler.com",
      "affectedData": [
        {
          "vendor": "Zscaler",
          "product": "Client Connector",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "Windows: 4.6.0.457, 4.7.0.317, 4.8.0.232, 4.9.0.372",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "MacOS: 4.5.2.312, 4.7.0.292, 4.8.0.191",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "iOS: 4.5.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "Android: 4.2",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "ChromeOS: 4.2",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "Linux: 3.7.2.64, 4.2.1.64",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Windows",
            "MacOS",
            "Linux",
            "iOS",
            "Android"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-24T14:16:55.690",
  "references": [
    {
      "url": "https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2026",
      "source": "cve@zscaler.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@zscaler.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-304"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal."
    }
  ],
  "lastModified": "2026-08-28T18:39:48.167",
  "sourceIdentifier": "cve@zscaler.com"
}