CVE-2026-59565: Zscaler Client Connector DoS Vulnerability

CVE-2026-59565 Overview

CVE-2026-59565 is a remotely exploitable buffer overflow in Zscaler Client Connector on Windows. The flaw allows a network-adjacent attacker with low privileges to trigger both local and kernel-level denial-of-service conditions on affected hosts. The Common Weakness Enumeration classifies this issue as [CWE-229] (Improper Handling of Values), with the overflow condition producing memory corruption reachable from the network path exposed by the client.

Critical Impact
Successful exploitation can crash the Windows kernel on endpoints running vulnerable Zscaler Client Connector builds, disrupting secure access and endpoint connectivity across the fleet.

Affected Products

Zscaler Client Connector for Windows (affected versions per vendor advisory)
Windows endpoints relying on Zscaler Client Connector for ZTNA and secure web gateway enforcement
Managed corporate laptops and virtual desktops running the Zscaler agent

Discovery Timeline

2026-08-24 - CVE-2026-59565 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-59565

Vulnerability Analysis

The vulnerability is a buffer overflow in Zscaler Client Connector for Windows. The client processes network-supplied input without adequate bounds enforcement, allowing an attacker to write beyond the allocated buffer. Because the agent interacts with kernel-mode components used for traffic interception and tunneling, the corrupted state propagates into the Windows kernel, producing a system-wide denial of service.

An attacker must have low-level privileges on a system able to reach the client over the network path it exposes. No user interaction is required. When the overflow condition is triggered, the affected host loses network protection and typically bugchecks, forcing a reboot. Because Zscaler Client Connector mediates enterprise access, downtime removes users from monitored network paths and can disrupt zero-trust enforcement across large fleets.

The EPSS probability at publication is 0.27%, indicating limited observed exploitation activity, but the network-reachable attack surface warrants prompt remediation.

Root Cause

The root cause is improper handling of a length-bearing value in a network-facing code path within the Client Connector. The client accepts input, uses an attacker-influenced size, and copies data into a fixed-size buffer without validating that the copy fits. This is characteristic of [CWE-229] handling errors that escalate into memory corruption.

Attack Vector

Exploitation occurs remotely over the network with low privileges required. An attacker sends a crafted message to the vulnerable Client Connector service on a Windows endpoint. Parsing the malformed input triggers the overflow, corrupts adjacent memory, and propagates the fault into kernel context. The result is a local and kernel denial-of-service on the target machine.

No public proof-of-concept code has been released for CVE-2026-59565. See the Zscaler Client Connector Release Summary for vendor technical details.

Detection Methods for CVE-2026-59565

Indicators of Compromise

Unexpected Windows bugchecks (BSOD) on endpoints running Zscaler Client Connector, often clustered in time across the fleet
Repeated crashes or restarts of the ZSATunnel, ZSAService, or related Zscaler processes
Sudden loss of Zscaler tunnel connectivity followed by system reboot on affected hosts

Detection Strategies

Correlate Windows Event Log entries for BugCheck (Event ID 1001) and unexpected shutdowns (Event ID 6008) with Zscaler service crashes
Monitor endpoint telemetry for abnormal termination of Zscaler Client Connector components followed by kernel faults
Inspect network traffic destined for local Zscaler client listener ports for malformed or oversized payloads

Monitoring Recommendations

Alert on repeated Zscaler Client Connector service crashes across multiple hosts within a short window
Track Client Connector version inventory to identify endpoints still running vulnerable builds
Ingest Windows kernel crash dumps into a centralized analysis pipeline to identify overflow signatures

How to Mitigate CVE-2026-59565

Immediate Actions Required

Inventory all Windows endpoints running Zscaler Client Connector and identify versions listed as vulnerable in the vendor advisory
Upgrade Client Connector to a fixed release as documented in the Zscaler Client Connector Release Summary
Prioritize patching for high-value users, servers, and jump hosts where downtime has the greatest operational impact

Patch Information

Zscaler has published fixed Client Connector builds for Windows. Refer to the Zscaler Client Connector Release Summary for the exact version numbers that address CVE-2026-59565 and follow the vendor's staged rollout guidance for enterprise deployment.

Workarounds

Restrict network reachability of Windows endpoints so untrusted hosts cannot send traffic to Client Connector listener ports
Enforce network segmentation to isolate user endpoints from unmanaged or guest networks
Where feasible, apply host-based firewall rules to limit inbound connections to the Client Connector service to trusted sources only

bash

# Windows Firewall example: restrict inbound access to Zscaler Client Connector listener
New-NetFirewallRule -DisplayName "Restrict ZCC Inbound" -Direction Inbound -Program "C:\Program Files\Zscaler\ZSATunnel\ZSATunnel.exe" -Action Block -Profile Public,Private