PatchDayAlert
Subscribe →
Daily Digest · 2 min read · 5 CVEs · Issue 87 By PatchDayAlert

Two 9.1s in Zscaler Client Connector: unauth RCE and portal auth bypass

ZCC has a pair of critical bugs (CVE-2026-59568, CVE-2026-59564, both CVSS 9.1) that could hand attackers full endpoint control or let them hijack agent-to-portal trust. Also: AWX path traversal via archive extraction (7.2), WebKitGTK use-after-free (8.8), and a CRLF injection in TIM Flow (8.1). None exploited in the wild yet.

Patch now
0
Within 24h
2
This week
3
Exploited
0
Zscaler Client ConnectorWindowsMacOSLinuxZscaler Client Connector PortalAWXAnsibleWebKitGTKTIM Flow

Two CVSS 9.1 bugs in Zscaler Client Connector landed today, and both are bad. CVE-2026-59568 lets an attacker run code without authentication on any endpoint running ZCC, which usually means SYSTEM-level access across your whole fleet. CVE-2026-59564 breaks the trust between ZCC and its management portal, opening the door to policy manipulation and traffic interception. Neither is exploited in the wild yet, but if you're a Zscaler shop, don't wait on these.

Today's CVEs

Sorted by urgency

01

CVE-2026-59568

NVD
9.1
CVSS
Patch within 24h CRITICAL
Zscaler Client ConnectorWindowsMacOSLinux

An attacker can run arbitrary code through Zscaler Client Connector without authentication or any special privileges. CVSS 9.1, and since ZCC usually runs with elevated permissions on endpoints, a successful exploit could give an attacker full control of the machine. Not yet exploited in the wild, but the attack surface here is wide if you have ZCC deployed across your fleet.

Affected estate
Anyone running Zscaler Client Connector on endpoints
How to check
Open ZCC on an endpoint and check the About/version info, or query your endpoint management tool for installed ZCC versions. Compare against the fixed version listed in Zscaler's advisory.
Included because
unauthenticated; remote code execution; CVSS 9.1; widely deployed endpoint agent
Action
Push the updated ZCC package through the Zscaler admin portal or your software deployment pipeline.
Why it matters
Unauthenticated RCE in an agent that runs on every endpoint means an attacker could compromise machines across your entire fleet.
Source
Zscaler advisory

Evidence trail

02

CVE-2026-59564

NVD
9.1
CVSS
Patch within 24h CRITICAL
Zscaler Client ConnectorZscaler Client Connector PortalWindowsMacOSLinux

An attacker can bypass authentication between the Zscaler Client Connector and its management portal. That could let someone impersonate the agent, manipulate policy enforcement, or intercept traffic routing decisions. CVSS 9.1, no exploitation in the wild yet, but the trust relationship between ZCC and its portal is a critical control point.

Affected estate
Anyone running Zscaler Client Connector and using the ZCC Portal for management
How to check
Verify the installed ZCC version on endpoints and confirm the portal version in the Zscaler admin console.
Included because
unauthenticated; authentication bypass; CVSS 9.1; affects trust boundary between agent and management plane
Action
Upgrade ZCC on all endpoints and confirm the portal component is patched.
Why it matters
An authentication bypass on the agent-to-portal channel could let an attacker subvert your zero-trust enforcement entirely.
Source
Zscaler advisory

Evidence trail

03

CVE-2026-71364

NVD
7.2
CVSS
Patch this week HIGH
AWXAnsibleLinux

AWX's project archive extraction doesn't sanitize filenames, so a malicious zip or tar archive can write files anywhere on the execution node's filesystem. If an attacker controls the archive content (compromised SCM, MITM on HTTP, or a malicious URL), they can drop cron jobs, SSH keys, or poisoned playbooks to get remote code execution. This requires the attacker to control or tamper with the archive source, so it's not a zero-click from the internet, but any AWX setup pulling projects over plain HTTP or from untrusted sources is at real risk.

Affected estate
Teams running AWX (the open-source Ansible Tower upstream) for automation
How to check
Run 'awx --version' or check the AWX web UI's About page. Review project sources for any using plain HTTP URLs.
Included because
path traversal to arbitrary file write; potential RCE; automation infrastructure is high-value target; CVSS 7.2
Action
Upgrade AWX to the patched release. Audit project sources and enforce HTTPS for all archive URLs.
Why it matters
Arbitrary file write on your automation controller can turn into full RCE, and your AWX nodes likely have SSH access to your entire managed fleet.
Source
AWX project advisory

Evidence trail

04

CVE-2026-78376

NVD
8.8
CVSS
Patch this week HIGH
WebKitGTKLinux

A use-after-free bug in WebKitGTK lets an attacker run code on your system by getting a user to visit a malicious web page. CVSS 8.8. This affects any Linux application that uses WebKitGTK for rendering web content, including GNOME Web (Epiphany) and other GTK-based browsers or embedded webviews. It does require user interaction: someone has to load the malicious content.

Affected estate
Linux sysadmins running desktops or applications that use WebKitGTK (GNOME, Epiphany, Evolution, GIMP help browser, etc.)
How to check
Run 'rpm -q webkit2gtk3' (RHEL/Fedora) or 'dpkg -l libwebkit2gtk*' (Debian/Ubuntu) to check the installed version.
Included because
memory corruption; user interaction required but low complexity; CVSS 8.8; common Linux component
Action
Apply the latest webkit2gtk3 or libwebkit2gtk update from your distro's repos.
Why it matters
Memory corruption via web content can give an attacker code execution under the user's context on any affected Linux workstation.
Source
WebKitGTK advisory / distro security tracker

Evidence trail

05

CVE-2026-39915

NVD
8.1
CVSS
Patch this week HIGH
TIM Flow

TIM Flow before 26.0.6 lets an attacker inject CRLF sequences into the 'rt' URL parameter, which gets reflected into Set-Cookie headers. That means an attacker can craft a link that, when clicked by an authenticated user, runs JavaScript in their browser session. The practical result: session hijacking and account credential changes. CVSS 8.1, but it does require a user to click a crafted link.

Affected estate
Teams running TIM Flow versions before 26.0.6
How to check
Check the TIM Flow version in the application's admin console or deployment configuration.
Included because
CRLF injection; reflected into headers; session hijack risk; CVSS 8.1; user interaction required
Action
Upgrade to TIM Flow 26.0.6 or later.
Why it matters
CRLF injection into response headers enables session theft and credential changes for any authenticated user who clicks a malicious link.
Source
TIM Flow vendor advisory

Evidence trail

One email, every Wednesday morning.

Subscribe

From the field notes

From this beat

Read the rest of the field notes →