Zscaler's 24 August 2026 CVE record describes multiple Client Connector flaws that allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context. Zscaler scored it 9.1 (CVSS 3.1).

The CNA points administrators to the 2026 Client Connector app release summary for fixed builds. Affected version strings in that record include Windows before 4.6.0.457 / 4.7.0.317 / 4.8.0.232 / 4.9.0.372, macOS before 4.5.2.312 / 4.7.0.292 / 4.8.0.191, Linux before 3.7.2.64 / 4.2.1.64, Android and ChromeOS before 4.2, and iOS before 4.5.1.

Confirm the exact build from the vendor release summary before declaring a fleet patched. Zscaler's CVE records (24 Aug 2026) also cover CVE-2026-59564 (authentication bypass in Client Connector to Portal communications), CVE-2026-59567 (local privilege escalation) and CVE-2026-59565 (buffer overflow causing local and kernel denial of service on Windows). Not in CISA KEV at last check.