AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ZscalerCVE-2026-59570

Zscaler Client Connector: improper input validation

Zscaler

CVE-2026-59570 · Published Sep 14, 2026 · updated Sep 18, 2026

High7.5
Fix: upgrade to Android: 4.2.0.152 or later (2 fixed versions below)
Zscaler advisory

On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture.

Affected versions

PackageAffectedFixed in
Client Connector
Product
< Android: 4.2.0.152Android: 4.2.0.152
< ChromeOS: 4.2.0.152ChromeOS: 4.2.0.152
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-20

More Zscaler advisories

All Zscaler
Medium 4.6Sep 28Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC...CVE-2026-59563fixed in 0.7.2Medium 4.4Sep 18Zscaler: improper input validationCVE-2026-25684no fix yetHigh 8.1Sep 14Zscaler Client Connector: improper input validationCVE-2026-59569fixed in Android: 4.2.0.152 +1High 8.1Sep 14Zscaler Client Connector: race conditionCVE-2026-25687fixed in 4.6.0.486 +3High 8.8Aug 24Zscaler Client Connector: privilege escalationCVE-2026-59567fixed in Windows: 4.6.0.457 +8Critical 9.1Aug 24Zscaler Client Connector: remote code executionCVE-2026-59568fixed in Windows: 4.6.0.457 +8