Client Connector App Release Summary (2026)

Zscaler Client Connector 4.2.0.174 Enhancements and Fixes

Fri, 21 Aug 2026 07:00:00 GMT

Fixes an issue where reauthentication failed after Zscaler Client Connector was upgraded to version 4.2.0.173.

Zscaler Client Connector 4.2.0.173 Enhancements and Fixes

Tue, 18 Aug 2026 07:00:00 GMT

Supports using the ind.zscalertwo.net subcloud in the cloudName installation parameter for Zscaler Client Connector deployments in India.
Fixes multiple Firebase-reported crashes.
Fixes a local denial-of-service attack vector. (CVSS v3.1 Base Score: 7.0 - High)
Mitigates multiple remote code execution vulnerabilities. (CVSS v3.1 Base Score: 7 - High)
Fixes an authentication bypass issue for Zscaler Client Connector to Zscaler Client Connector Portal-only communications. (CVSS v3.1 Base Score 6.8 - High)
Fixes an issue that occurred on ChromeOS only where, after upgrading, authentication failed when Zscaler Client Connector was deployed via the Google Workspace with Always On VPN configured.
Improves reconnection performance of Zscaler Tunnel (Z-Tunnel) 2.0 and Private Access after network connectivity is restored, shortening the time to reestablish services.
Fixes an issue where Authentication Service users couldn’t access private applications because configuration parameters for Private Access weren’t updated after upgrading Zscaler Client Connector and were missing from Private Access diagnostic logs.
Fixes an issue where Digital Experience (ZDX) background probes continued running while the device was in standby (screen off), preventing doze mode and increasing battery drain.

Zscaler Client Connector 4.2.0.152 Enhancements and Fixes

Thu, 09 Jul 2026 07:00:00 GMT

Fixes an issue with Zscaler Client Connector where users were unable to log in to Zscaler Client Connector and were unable to complete Zscaler Internet Access (ZIA) registration on version 4.2.0.137.
Fixes a security vulnerability by hardening the outgoing socket-level connection created by the VPN API method. (CVE-2026-59569)
Fixes a security vulnerability by hardening the communication for Zscaler Client Connector internal broadcasts. (CVE-2026-59570)

Zscaler Client Connector 4.2.0.137 Enhancements and Fixes

Thu, 11 Jun 2026 07:00:00 GMT

Fixes an issue where the Client Certificate posture type was unintentionally removed in Zscaler Client Connector. This update restored the feature for customers still using it and hardened certificate validation to improve security. However, the Client Certificate posture type for Android will be removed by September 2026. To learn more, see End-of-Support for the Client Certificate Posture Type for All Android Devices.
Fixes an issue in which Google Workspace account authentication failed in some Zscaler Tunnel (Z-Tunnel) 1.0 environments. Authentication worked in Chrome or directly in Zscaler Client Connector, but failed within the affected app flow because traffic was not routed as expected.

Zscaler Client Connector 4.2.0.133 Enhancements and Fixes

Thu, 04 Jun 2026 07:00:00 GMT

Fixes an issue where users were unable to log in to Zscaler Client Connector on Chromebooks because device registration failed after the SAML response.
Supports the httpAuthAllowedHosts parameter to allow redirected hostnames to be added to the exception list, which addresses an issue where users were unable to authenticate with SAML-based IdP authentication for Zscaler Internet Access (ZIA) after upgrading to Zscaler Client Connector version 4.2.0.129. To learn more, see Supported Parameters for Zscaler Client Connector for Android and Android on ChromeOS.

Zscaler Client Connector 4.2 Enhancements and Fixes

Mon, 01 Jun 2026 07:00:00 GMT

Fixes an authentication bypass issue for Zscaler Client Connector to Zscaler Client Connector Portal-only communications. (CVE-2026-59564)
Fixes a local denial-of-service attack vector. (CVE-2026-59566)
Mitigates multiple remote code execution vulnerabilities. (CVE-2026-59568)
Removes support of legacy cipher suites from Zscaler Client Connector TLS connections.
Supports step-up authentication for conditional access to Zscaler Private Access (ZPA) and Zscaler Internet Access (ZIA) based on dynamic requests for stronger authentication for Authentication Service-enabled tenants. To learn more, see Verifying Access to Applications.
Updates the DNS TXT record query in Disaster Recovery mode to send the query to all DNS servers.
Adds support to use a PROXY return statement in the PAC file used with ZIA Disaster Recovery Configuration so that internet traffic is sent to a proxy server.
Supports user-driven fallback from Zscaler Tunnel (Z-Tunnel) 2.0 to Z-Tunnel 1.0 when UDP connectivity issues arise.
Enables overriding the Z-Tunnel 2.0 protocol settings To learn more, see Allow Users to Override Z-Tunnel 2.0 or ZPA Protocol Settings.
Adds support for debugging the Z-Tunnel 2.0 data-channel traffic after the 3.0 update changed the encryption algorithm from NULL to AES-GCM, by exporting the data-channel encryption key for troubleshooting.
Updates the OpenSSL version to 3.5.5.
Fixes an issue where the destination leg index in reverse traceroute in Digital Experience (ZDX) was incorrect.
Fixes an issue where users received the message, To maintain proper performance, Zscaler is crashing frequently. Put the app into deep sleep when Zscaler Client Connector crashed after network changes and failed to automatically recover, causing users to lose access to the internet and to private applications.

Zscaler Client Connector 4.1.0.77 Enhancements and Fixes

Fri, 03 Apr 2026 07:00:00 GMT

Fixes an issue where Zscaler Client Connector didn’t drop QUIC traffic in Zscaler Tunnel (Z-Tunnel) 1.0 mode even though Drop QUIC Traffic was enabled in app profiles.
Fixes an issue where Android devices became unregistered after the immediate keepalive because the External Device ID and username were provided without the domain name via the mobile device management (MDM).
Fixes an issue where the Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) services remained stuck in a Disconnecting state until the user restarted the application when Z‑Tunnel didn’t exit cleanly and the tray entered an infinite disconnecting loop.
Fixes multiple Firebase-reported crashes.
Fixes an issue where Zscaler Client Connector was stuck in a Connecting state.
Fixes an issue that caused Zscaler Client Connector to crash when trying to register the device with Authentication Service.

Zscaler Client Connector 4.1.0.70 Enhancements and Fixes

Wed, 18 Feb 2026 08:00:00 GMT

Fixes an issue where auto-enrollment failed and an Invalid Device Token message displayed for users on Android 11 after logging in when Zscaler Client Connector was deployed through mobile device management (MDM).
Fixes a Firebase crash.
Fixes an issue where Zscaler Client Connector crashed on Android 9.0 when running Zscaler Client Connector version 4.1 because of an incompatible PAC parser library.

Zscaler Client Connector 4.1.0.63 Enhancements and Fixes

Mon, 02 Feb 2026 08:00:00 GMT

Fixes an issue where web traffic bypassed Zscaler Tunnel (Z-Tunnel) 2.0 for users on Zscaler Client Connector version 4.1.0.53.
Fixes an issue where DNS responses over Z-Tunnel 2.0 failed.

Zscaler Client Connector 4.1 Enhancements and Fixes

Tue, 13 Jan 2026 08:00:00 GMT

Supports IPv6 traffic forwarding from IPv6-only Android devices to Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA). To learn more, see Enabling IPv6 Resolution for Zscaler Domains.
Supports the ability to force remove devices from the Zscaler Client Connector Portal for Authentication Service users.
Supports using one-time passwords (OTPs) for Authentication Service users with Authentication Service tenants.
Supports the ability to quarantine and unquarantine devices from the Zscaler Client Connector Portal for Authentication Service users.
Supports the option to fetch logs remotely for Authentication Service users.
Improves multi-cloud selection for tenants registered on multiple Zscaler clouds.
Supports Zscaler Client Connector discovering the optimal path maximum transmission unit (MTU) for Zscaler Tunnel (Z-Tunnel) 2.0. To learn more, see Configuring Forwarding Profiles for Zscaler Client Connector.
Adds two new options for the Z-Tunnel 2.0 protocol bypass feature: Redirect Web Traffic to Zscaler Client Connector Listening Proxy and Use Z-Tunnel 2.0 for Proxied Web Traffic. To learn more, see Configuring Forwarding Profiles for Zscaler Client Connector.
Supports packaging the Zscaler Client Connector Portal configuration into an encrypted log file when exporting logs.
Fixes a Firebase crash.
Fixes an issue where SSH sessions on Chromebooks randomly froze with the error message client\_loop sent disconnect I/O error.
Fixes an issue where Chromebook users experienced intermittent connectivity issues with ZPA while using Zscaler Client Connector.
Fixes an issue where auto-enrollment failed during login for Chromebook users.
Fixes an issue where browser-based authentication failed because Zscaler Client Connector couldn’t detect the user's domain, causing login attempts to fail with a Username not valid error, even when correct credentials were provided.
Fixes an issue where the Service Status for Digital Experience (ZDX) displayed a server error instead of a network error when users experienced internet connectivity issues.
Fixes an issue where an incorrect device group-based app profile was assigned.