First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-59570

HighCVSS 7.5/10Last modified Sep 18, 2026

Description

On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Zscaler	Client Connector	< Android: 4.2.0.152; < ChromeOS: 4.2.0.152

References

https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2026

Timeline

Published: Sep 14, 2026
Last modified: Sep 18, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-595737.8In max_num_ref_frames of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escala CVE-2026-595742.4In notifyPollingLoopFrames of hal_fwlog.cc, there is a possible way to trigger an out of bounds read and write when formatting firmware log CVE-2026-595756.2In stpropnci_cb_observe_mode_suspend of stpropnci_prop_android.cc, there is a possible way to trigger an out of bounds write into global sta CVE-2026-595787.8In s_check_valid_tile_param_custom_tile of av1_encoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could le CVE-2026-595794.0In getUserDataPayload of GC2UserData.cpp, there is a possible Logic error due to a logic error in the code. This could lead to local informa CVE-2026-59582.1When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic file CVE-2026-595803.3In trusty_context_switch of services/spd/trusty/trusty.c, there is a possible Secure world register state leak due to a logic error in the c CVE-2026-595827.5In StartTimer of UcePublishManager.cpp, there is a possible way to trigger a process abort during timer calculation due to an integer overfl CVE-2026-595832.7In FormCredentials of SipAuHelper.cpp, there is a possible way to disclose authentication credentials in cleartext via a scheme downgrade du CVE-2026-595857.5In SetDisplayName of RegInfoContact.cpp, there is a possible denial of service due to a missing null check. This could lead to remote denial CVE-2026-595864.0In multiple locations, there is a possible way to recover cryptographic keys and forge authentication tags due to improperly used crypto. Th CVE-2026-595878.4In stpropnci_prop_st_build_set_custom_polling_cmd of stpropnci_prop_st.cc, there is a possible way to trigger an out of bounds write into gl

CVE-2026-59570: High severity, CVSS 7.5 | Vulnix