CVE-2026-59566: Zscaler Client Connector DoS Vulnerability

CVE-2026-59566 Overview

CVE-2026-59566 is a locally exploitable buffer overflow in Zscaler Client Connector on Android and ChromeOS. An attacker with local access can trigger the overflow to cause a denial-of-service condition on the affected device. The issue is tracked under CWE-229 (Improper Handling of Values) and carries a CVSS 3.1 base score of 8.4. The flaw requires no user interaction and no privileges, but the attack vector is limited to local access. Successful exploitation impacts confidentiality, integrity, and availability of the Client Connector process on the endpoint.

Critical Impact
A local attacker can trigger a buffer overflow in Zscaler Client Connector on Android and ChromeOS, causing denial of service on the endpoint.

Affected Products

Zscaler Client Connector on Android
Zscaler Client Connector on ChromeOS
Refer to the Zscaler Client Connector Release Summary for exact fixed versions

Discovery Timeline

2026-08-24 - CVE-2026-59566 published to the National Vulnerability Database (NVD)
2026-08-24 - Last updated in NVD

Technical Details for CVE-2026-59566

Vulnerability Analysis

The vulnerability is a buffer overflow in the Zscaler Client Connector application running on Android and ChromeOS. The flaw is classified under CWE-229, indicating the Client Connector fails to correctly handle input values before they reach a fixed-size buffer. When an attacker with local access supplies malformed input to the affected component, the process writes beyond the intended memory boundary. The result is a denial-of-service condition against the Client Connector agent on the endpoint.

Because Zscaler Client Connector enforces secure access and traffic forwarding policies for the endpoint, crashing the agent can disrupt enforcement of corporate network controls until the agent restarts. The vulnerability requires local access, which limits remote exploitation but keeps the issue relevant on shared or unattended mobile devices.

Root Cause

The underlying defect is improper handling of input values in a Client Connector code path on Android and ChromeOS, consistent with CWE-229. Missing or insufficient bounds validation allows data to exceed the target buffer during processing. Zscaler has not published exploit primitives, and no proof-of-concept code is publicly available.

Attack Vector

Exploitation requires local access to the device running Zscaler Client Connector. An attacker with an installed application, adjacent process, or shell-level access delivers crafted input to the vulnerable component. Because no privileges and no user interaction are required, any low-privileged local context capable of reaching the affected surface can trigger the overflow.

No verified exploit code is available. Consult the Zscaler Client Connector Release Summary for vendor-published technical details.

Detection Methods for CVE-2026-59566

Indicators of Compromise

Unexpected crashes or restarts of the Zscaler Client Connector process on Android or ChromeOS devices
Sudden gaps in Zscaler traffic forwarding, tunnel establishment, or policy enforcement logs from the endpoint
Application crash entries referencing the Client Connector package in Android logcat or ChromeOS system logs

Detection Strategies

Monitor mobile device management (MDM) and endpoint telemetry for repeated Client Connector process terminations on Android and ChromeOS
Correlate Client Connector service interruptions with recent application installs or local activity on the affected device
Track Client Connector version inventory across the fleet to identify endpoints still running vulnerable builds

Monitoring Recommendations

Forward Zscaler Client Connector health and connection status events to a centralized logging platform
Alert on abnormal frequency of agent crashes or restarts within short time windows on individual devices
Review Android and ChromeOS crash reports for stack traces originating in the Client Connector application

How to Mitigate CVE-2026-59566

Immediate Actions Required

Identify all Android and ChromeOS endpoints running Zscaler Client Connector and inventory installed versions
Update Zscaler Client Connector to the fixed release identified in the Zscaler Client Connector Release Summary
Enforce updates through the organization's MDM or enterprise mobility platform to remove exposure across the fleet

Patch Information

Zscaler has published fixed builds through its normal Client Connector release process. Consult the Zscaler Client Connector Release Summary for the specific patched versions for Android and ChromeOS and deploy them across managed devices.

Workarounds

Restrict installation of untrusted third-party applications on managed Android and ChromeOS devices that could deliver local exploit payloads
Apply MDM policies that limit local shell access, sideloading, and developer mode on affected endpoints
Monitor Client Connector agent health and automatically reinstall or restart the agent when repeated crashes are detected