Threat Intelligence Report: CVE-2026-59566

Executive Summary

CVE-2026-59566 is a locally exploitable buffer overflow vulnerability in Zscaler Client Connector affecting deployments on Android and ChromeOS platforms. The flaw enables a local denial-of-service (DoS) condition, allowing an unprivileged local attacker to crash the client process. Despite its local attack vector, the CVSS score of 8.4 (High) reflects the severity due to no privileges being required (PR:N), no user interaction (UI:N), and complete loss of availability, confidentiality, and integrity (C:H/I:H/A:H). No patch is currently available; the vulnerability remains unpatched with zero patch confidence, and no public exploit or proof-of-concept has been disclosed.

The vulnerability affects enterprise deployments where Zscaler Client Connector is installed on managed Android and ChromeOS devices — commonly used in BYOD and corporate-issued mobile fleets for zero-trust network access. Given the product's role in enforcing security policy and routing corporate traffic, a successful exploit could disrupt secure communications, knock devices off the Zscaler security cloud, and potentially expose users to unfiltered internet access by disabling protection. While no patch exists, immediate mitigation should focus on restricting local device access and monitoring for crashes or abnormal client terminations.

Technical Analysis

Vulnerability Class: CWE-229 — Improper Handling of Values (buffer overflow). The NVD description confirms a "locally exploitable buffer overflow bug" affecting Zscaler Client Connector specifically on Android and ChromeOS. The overflow is triggerable locally, meaning the attack surface is the local device environment rather than the network.

Attack Surface and Mechanism: The Zscaler Client Connector is a security agent that intercepts and inspects network traffic on endpoints, enforcing zero-trust access policies. On Android and ChromeOS, the client runs as a system-level application with elevated privileges to perform VPN tunnel termination, TLS interception, and policy enforcement. A buffer overflow in this context indicates the application fails to properly validate the size of input data it processes — a classic memory-corruption flaw. Because the description specifies "locally exploitable," the trigger likely occurs via locally accessible interfaces such as IPC calls from other local apps, malformed local configuration payloads, or specially crafted data delivered through a local socket or content provider.

Technical Specifics: The NVD description provides no further implementation details — no affected function names, file paths, or entry points are disclosed. Insufficient technical detail is available regarding the exact code path. However, buffer overflow on mobile endpoints typically results when a process copies data into a fixed-size stack or heap buffer without adequate bounds checking. Service-specific mechanisms such as Google's Android Binder IPC or ChromeOS's service brokers could be involved if the connector exposes local services; these are common delivery channels for local privilege escalation or DoS on mobile platforms. Without disclosure, the precise trigger interface remains unknown.

Impact Chain: A crash of the Zscaler Client Connector would terminate the security agent, potentially disabling: (1) the VPN tunnel to the Zscaler cloud, (2) TLS interception and DPI enforcement, (3) policy-based access controls, and (4) on-device security posture reporting. Enterprise security teams would lose visibility and enforcement on affected devices. Repeated exploitation could keep the agent in a crash-loop state, requiring manual intervention by IT administrators.

The CVSS vector underscores the severity despite local access: Preconditions are minimal (PR:N — no privileges; UI:N — no user interaction), and the scope is unchanged (S:U). The high confidentiality/integrity/availability subscores (C:H/I:H/A:H) likely reflect the broad security control loss on the host if the client is disabled — the device may no longer be protected by Zscaler policy, exposing users to threats and enabling policy bypass (integrity/confidentiality impact from a security-control perspective, even if the overflow itself only causes a crash).

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available. The attack chain below is inferred from the vulnerability class (CWE-229 buffer overflow) and the described local DoS impact only; specific implementation details are not disclosed and are not fabricated here.

Step 1 — Reconnaissance/Target Identification: An attacker with local access to a managed Android or ChromeOS device identifies that Zscaler Client Connector is installed. On a shared or borrowed corporate device, the attacker can enumerate running processes, installed packages, or visible status-bar indicators (VPN icon, Zscaler branding). No network scanning is required — the target is a specific local application. Local access could be obtained via a malicious sideloaded app on the device, shell access, or physical device possession on an unlocked/chromebook in a kiosk scenario.

Step 2 — Triggering the Flaw: The attacker triggers the buffer overflow by delivering a malformed input sequence to the connector's locally accessible processing path — potentially via an IPC call, a crafted local intent, or by writing a specially sized payload through a local interface the client consumes. The exact interface is unknown from the description, but the attack class requires the attacker to control or influence data length/contents that the client copies into an undersized buffer without validation.

Step 3 — Payload/Execution Method (vulnerability-class level): The payload is an oversized or malformed data structure sent to the vulnerable parsing routine. On a stack-based overflow, the crafted payload overflows an on-stack buffer, corrupting adjacent memory and typically crashing the process; on a heap-based overflow, metadata corruption likewise leads to termination. Given the DoS-only description, the attacker's intent is to cause a crash rather than code execution — the overflow is likely used to force a termination or exception state. No remote code execution is described in the NVD data.

Step 4 — Post-Exploitation Impact: Following the crash, the Zscaler Client Connector process terminates or enters a crash-loop. The device loses:

• The secure VPN tunnel to the Zscaler zero-trust cloud.
• TLS inspection, URL filtering, and policy enforcement.
• Posture reporting to the enterprise security operations center.

Network traffic may fall back to direct internet access with no Zscaler protection (depending on enforced firewall rules), enabling the device to reach potentially malicious destinations or bypass corporate policy. Repeated exploitation yields persistent DoS on the security agent until an administrator manually intervenes. If the connector honors a "fail-open" policy on crash (common in VPN clients to avoid total connectivity loss), the security gap widens further; if "fail-closed," the user loses network access entirely — both scenarios constitute denial of service.

The enterprise-wide blast radius affects any fleet using Zscaler Client Connector on Android/ChromeOS. A targeted attacker who can compromise or control a single managed device (e.g., via a malicious app or physical access) can disable the security agent on that device and evade centralized policy. No evidence exists of in-the-wild exploitation or active threat actor campaigns at the time of this report.

Impact Assessment

Business Impact: This vulnerability degrades the security posture of mobility fleets using Zscaler Client Connector. The Zscaler Client Connector is a critical security control on managed devices; its failure exposes users to unfiltered internet, allows potential policy bypass actions (both from compromised devices and user behaviors), and weakens zero-trust enforcement. Affected are organizations deploying Zscaler's Zero Trust Exchange on Android and ChromeOS devices — common in healthcare, financial services, government, and other regulated sectors.

Affected Systems: Zscaler Client Connector installations on Android (including BYOD and fully managed COPE devices) and ChromeOS (corporate Chromebooks, kiosks, and managed Chrome Enterprise environments). Exact affected version ranges are unknown — all current versions should be considered potentially vulnerable given the zero patch confidence.

Blast Radius: Local only — exploiting the bug requires local access to the device. However, the security-impact subscores are maximally severe (C:H/I:H/A:H) because a crash of the connector disables a enterprise-grade security appliance on the endpoint, representing a direct loss of confidentiality and integrity protection (users lose TLS inspection; apps may send sensitive data unprotected; policy tracking is lost). The availability impact (crash/DoS) is the direct and verified component. No evidence of remote or network-based exploitation is present in the data.

CVSS Reference: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.4 High).

Detection Guidance

Detection of this vulnerability is challenging because exploitation occurs locally and leaves few network artifacts. The primary observable signals are (1) crash and error logs on the endpoint, (2) unexpected termination/restart of the Zscaler process, and (3) anomalous local IPC or file activity targeting the connector's data directory. Below are detection rules focused on host-based telemetry.

Sigma Rule

title: Zscaler Client Connector Local Buffer Overflow - Process Crash
id: 6c3f9f1e-8d4b-4c0a-b2e3-7adf41a99c21
status: experimental
description: Detects potential buffer overflow crash of Zscaler Client Connector on Android/ChromeOS endpoints - CVE-2026-59566
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-59566
author: Valtersit Threat Intelligence
date: 2026/06/01
logsource:
    category: process_creation
    product: windows
    service: null
detection:
    selection_crash:
        EventID: 4688  # Process creation (fallback for proxy)
    selection_zscaler:
        Image|endswith:
            - '\zsaclient.exe'
            - '\zscaler.*'
        CommandLine|contains: 'zscaler'
    condition: selection_crash and selection_zscaler
falsepositives:
    - Legitimate Zscaler Client Connector restarts during updates
level: medium
tags:
    - attack.t1204
    - cve.2026-59566

YARA Rule

rule Zscaler_Client_Connector_Buffer_Overflow_CVE_2026_59566
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects indicators related to Zscaler Client Connector buffer overflow (CVE-2026-59566) on Android/ChromeOS"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-59566"
        date = "2026-06-01"
        cve = "CVE-2026-59566"
    strings:
        $s1 = "Buffer overrun detected" ascii nocase
        $s2 = "Zscaler Client Connector" ascii nocase
        $s3 = "Unhandled exception" ascii nocase
        $s4 = "memory corruption" ascii nocase
        $s5 = "stack buffer" ascii nocase
        $s6 = "heap buffer" ascii nocase
        $s7 = "security tunnel" ascii nocase
    condition:
        uint16(0) == 0x5A4D and  // MZ header (PE executable)
        (
            any of ($s1, $s2, $s3, $s4, $s5, $s6, $s7)
        )
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-59566 Zscaler Client Connector Local Buffer Overflow - Anomalous Local Traffic"; flow:to_server; content:"zscaler"; nocase; content:"client"; nocase; classtype:attempted-dos; sid:202659566; rev:1; metadata:cve CVE-2026-59566;)

Elastic Detection

// Detect crash events for Zscaler Client Connector process (endpoint telemetry)
process where event.type == "end" and process.name in ("zsaclient", "zscaler") and
    process.exit_code != 0 and
    process.name == "zsaclient"

Splunk SPL Query

index=endpoint sourcetype="WinEventLog:Security" OR sourcetype="process_creation"
| search (Image="*zsaclient*" OR Image="*zscaler*") AND (
    EventID=4688 OR EventID=4689
)
| table _time, host, User, Image, New_Process_Name, Process_Commandline
| eval is_corrupt=if(match(Process_Commandline, "(?i)crash|exception|corrupt|overflow"), "TRUE", "FALSE")
| where is_corrupt=="TRUE" OR exit_code != 0
| stats count by host, Image

Wazuh OSSEC Rule

<group name="zscaler,">
  <rule id="100566" level="10">
    <decoded>crash</decoded>
    <match>zsaclient|zscaler</match>
    <description>CVE-2026-59566: Possible Zscaler Client Connector buffer overflow - process crash detected</description>
    <group>local_dos,</group>
    <mitre>
      <id>T1204</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED — patch confidence 0/4. No vendor advisory, security fix, version release, or workaround has been published by Zscaler for CVE-2026-59566 at the time of writing. There is no evidence this CVE has been added to CISA's Known Exploited Vulnerabilities catalog.

1) Immediate Mitigations (no patch available):

• Restrict local device access. Enforce device lock policies, disable USB debugging on Android, and prevent sideloading of untrusted apps. On ChromeOS, restrict kiosk or public-session usage where physical access is uncontrolled.
• Monitor for crashes. Deploy EDR/MDM alerting on crash events for the Zscaler Client Connector process (see detection guidance). Correlate unexpected client restarts with user or device anomalies.
• Minimize local attack surface. Disable guest accounts, app installation from unknown sources, and developer mode on ChromeOS; enforce Android enterprise device policies to deny sideloading and untrusted app installs.
• Review fail-open/fail-closed settings. Ensure your Zscaler policy configuration defines how the connector behaves on crash to avoid silent security bypass; consider a "fail-closed" posture where connectivity blocks when the agent is down.
• Segment shared/managed fleets. If possible, temporarily move high-risk device populations (shared kiosks, loaner devices) to other platforms or restrict their network access until a patch ships.

2) Patch/Upgrade Steps:

• Monitor Zscaler's official security advisories (https://help.zscaler.com) and the vendor's product update pages for Android Client Connector and ChromeOS Client Connector releases.
• When available, apply the patched version immediately to all managed Android and ChromeOS devices via your MDM (MobileIron, Workspace ONE, Intune, Zscaler's own deployment tooling).
• Prioritize devices that are most exposed: shared devices, devices with known local-user accounts, and devices in public/kiosk environments.

3) Long-Term Hardening:

• Adopt a reliable patch cadence for the Zscaler Client Connector across your mobile fleet — subscribe to Zscaler security notifications and track CVE feeds.
• Implement Least-Privilege and Zero Trust policies at the application level; ensure your device-management tool forbids user escalation.
• Regularly audit local device accounts and remove shared/inactive profiles.
• Maintain incident response runbooks for security-agent crashes tied to supplier-produced endpoints.
• Consider compensating controls: network-level filtering at the Zscaler cloud still enforces policy if the on-device agent fails; ensure your configuration routes all traffic through Zscaler regardless of agent state (with fail-closed enforcement).

References

1. NVD Entry for CVE-2026-59566 — https://nvd.nist.gov/vuln/detail/CVE-2026-59566
2. Zscaler Product Security Advisories — https://help.zscaler.com (monitor for official advisory for CVE-2026-59566 when released)
3. CWE-229: Improper Handling of Values — https://cwe.mitre.org/data/definitions/229.html
4. MITRE ATT&CK — T1204 User Execution — https://attack.mitre.org/techniques/T1204/
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-59566 not listed at publication)

Threat Actor Campaigns / In-the-Wild Exploitation: No evidence of exploitation in the wild, active campaigns, or public proof-of-concept exists as of the report date. The vulnerability is unpatched; monitor for future disclosures of exploit activity.