Release Upgrade Summary (2025)

Security Fixes

Wed, 17 Dec 2025 08:00:00 GMT

Proper validation of user input in the ZIA Admin Portal no longer allows an authenticated administrator to initiate back end functions through specific input fields in limited scenarios (CVE-2026-22567).

Automatic Local Language Translation for Isolation in ZIA

Mon, 15 Dec 2025 08:00:00 GMT

Automatic language translation is globally available for Isolation. The isolated session localizes the language based on the user's browser language settings, and displays that language on the rendered web page.

To learn more, see Understanding Language Translate for Isolation.

Original URL for Isolation Profiles in ZIA

Mon, 15 Dec 2025 08:00:00 GMT

Original URL has replaced Local Browser Rendering in Isolation. It is now an option that admins can configure in isolation profiles. This means that the user of the isolation profile sees the native browser URL of the web page that loads when entering Isolation.

To learn more, see User Experience Modes in Isolation and Original URL for Isolation.

Visual Indicator for Turbo Mode in Isolation for ZIA

Mon, 15 Dec 2025 08:00:00 GMT

If Turbo Mode is enabled on an isolation profile and the user also has hardware acceleration enabled, the appearance of the zGPU icon next to the Turbo Mode command is displayed in the Isolation Bar.

Affected Models/Endpoints	Deprecated Attributes	New Attributes	Implemented Changes
`WebDlpRule` and `WebDlpSubRule` models in `/webDlpRules` endpoints	`zscalerIncidentReceiver` `icapServer`	`receiver`	Previously, `icapServer` was used in combination with `zscalerIncidentReceiver` (Boolean) to specify the Zscaler Incident Receiver or ICAP server details for a rule. Currently, the `receiver` attribute specifies the DLP Incident Receiver for all three ncident Receiver types: Zscaler Incident Receiver, ICAP server, and Cloud-to-Cloud Incident Forwarding.
`CASBDlpRule` model in `/casbDlpRules` endpoints	`zscalerIncidentReceiver` `icapServer`	`receiver`	Previously, `zscalerIncidentReceiver` and `icapServer` were used to specify the Zscaler Incident Receiver or an ICAP server respectively to associate with a rule. Currently, the `receiver` attribute specifies the DLP Incident Receiver for all three Incident Receiver types: Zscaler Incident Receiver, ICAP server, and Cloud-to-Cloud Incident Forwarding.

Old Policy Reason	New Policy Reason
Reputation block outbound request: adware/spyware site	Not allowed to use Adware/Spyware sites
Not allowed because URL is blacklisted	Not allowed because URL is placed on the denylist
Not allowed to access internet	Block Internet Access
Not allowed to browse this category, needs override	Not allowed to browse this category
IPS block: cryptomining & blockchain traffic	IPS block: cryptomining traffic
Not allowed to upload media files to this site	Not allowed to upload files to this site
Communication with unknown servers	Blocked Mobile App communicating with remote unknown servers
Communication with ad sites	Blocked Mobile App communicating to Ad websites
Information identifying the device	Blocked Mobile App leaking Device Identifier information
Location information leak	Blocked Mobile App leaking Location information
Insecure user credentials	Blocked Mobile App leaking user credentials insecurely
Malicious behavior	Blocked Mobile App exhibiting malicious behavior
Personally Identifiable Information (PII)	Blocked Mobile App leaking Personally Identifiable Information (PII)
Known security vulnerabilities	Blocked Mobile App with known security vulnerabilities
Cautioned to use this Social Network site	Cautioned the use of this Social Network site
Cautioned to use this Streaming Media site	Cautioned to use this Streaming/Media site
Not allowed to use this Streaming Media site	Not allowed to use this Streaming/Media site
Unenrolled user is not allowed to establish SSL connection, use non-SSL URL to enroll	Unenrolled user is not allowed to establish SSL connection

Release Upgrade Summary (2025)

Security Fixes

Automatic Local Language Translation for Isolation in ZIA

Original URL for Isolation Profiles in ZIA

Visual Indicator for Turbo Mode in Isolation for ZIA

Gen AI Prompt Configuration for Claude and Mistral

Added Claude and Mistral Capabilities to URL & Cloud App Control Policy Settings Endpoint

Create VM Instance using the Virtual Service Edge Amazon Web Services Terraform Modules

Enhancement to Filters in 3rd-Party App Governance and Advanced SSPM

Support for GitHub User Email Enrichment in 3rd-Party App Governance

Support for Google Workspace OU Segregation

Updates to 3rd-Party App Governance API

Additional Logging of Users Performing Actions on File

Insights Logs

NSS Feeds

Enhancements to Endpoint DLP for Windows

Endpoint DLP Support for Clipboard and Application File Access

Removable Storage Rule: Device Per User Pair

Endpoint Data Scan - End User Report

Endpoint DLP Configurations

Applications Inventory

Device Investigation

Sensitive Information Index Document Match (IDM)

Additional Support for Predefined DLP Dictionaries in Endpoint DLP

Added Context for Endpoint DLP Triggers

Endpoint DLP Support for Proximity Length in Predefined Dictionaries

Support for New SSPM Controls for GitHub

Web EUN for DNS Control Policy

Traffic Capture for NDR

Update to Cloud Service API

Creative Commons Search Results

Apply MIP Label as Manual Remediation Action in SaaS Security Assets

Support for Sublocation Scopes

Update to Cloud Service API

JWT Authentication

JWT Authentication Support for Workloads on Management Portal for Partners

Create VM Instance using the Virtual Service Edge Azure Terraform Modules

Support for Enhanced US Driver's License Dictionary and Sub-Dictionaries

Enhancement to Custom Views in 3rd-Party App Governance

Zscaler Client Connector EUNs for Firewall, DNS, and IPS Policies

Support for Adaptive Access Engine

Logs for Adaptive Access Profile

Updates to SaaS Security Endpoints

Automatic Session Restore for Isolation

Original URL of Website Name in Isolation

New AI/ML Cloud Applications

Advanced SaaS Security Posture Management Support for Docusign

New Network Applications in Firewall Control

Support for New SaaS Application Tenant

Support for New SSPM Controls for Snowflake

Logs for Post-Quantum Cryptography Visibility

Interactive Reports: Post-Quantum Cryptography Visibility

Web Insights Data Types

Web Insights Logs

NSS Feeds for Web Logs

Support for Quarantine File to Desired Location

SaaS Application Tenant Onboarding

Quarantine Files That Violate DLP Policy in a Desired Location

Remediation Actions in Assets with Incidents Page

Support for Custom File Types in DLP and File Type Control Policies

Update to Cloud Service API

Support for Custom File Types in File Type Policies and DLP

Enhancement to SafeSearch

Enhancement to the URL & Cloud App Control Policy Settings Endpoint

File Type Support for File Type Control & DLP

Shadow IT Report Enhancements

Strict Checking of Popular Date Formats in EDM

Document Classification and Logging

Updates to Insights Logs

Updates to NSS Feeds

New Cloud Applications

Support for Expandable Limit for Users, Groups, Locations, & Departments in Policies

Gen AI Application Category in NSS Feeds for SaaS Security Logs

SSL Inspection for IoT Devices

Support for Expandable Limit for Users, Groups, Locations, & Departments per Rule

Content Location Match Criteria for Web DLP Rules

Update to Cloud Service API

OpenOffice File Type Support for DLP

Async Location Download

Enhancement to the IP Destination Groups Endpoint