Client Connector App Release Summary (2026)

Zscaler Client Connector 4.10.0.477 Enhancements and Fixes

Wed, 30 Sep 2026 07:00:00 GMT

Fixes an issue where default Wi-Fi interface binding issues could occur after upgrading Zscaler Client Connector, resulting in an Endpoint FW/AV error.
Fixes an issue where Zscaler Client Connector the VPN Service Edge as connected even after a network disconnect.
Fixes an issue where users could not load their captive portal due to Zscaler Client Connector failing to detect the portal.
Updates VPN (for Legacy Apps) to continue retrying gateway connections with an exponential backoff capped at 60 seconds, even after 5 successive failures.
Fixes an issue where, after reauthentication to Private Access, the Zscaler Client Connector app icon could disappear until a service restart.
Fixes an issue where the app could crash after a Private Access connection reset while Zscaler Client Connector was clearing buffered data after the connection closed.
Fixes an issue where, after removing and then re-adding a network segment, the routing table wasn't updated, preventing the user from connecting to that segment until they restarted Zscaler Client Connector.
Fixes an issue where Zscaler Client Connector correctly used the PAC file entered for overriding protocol settings initially but then replaced it with the PAC file from the app profile.
Fixes an issue where the app displayed the partner tenant username as the signed-in user when a user added or logged in to a partner tenant after enrolling in the main tenant.
Fixes a connectivity issue in Zscaler Tunnel (Z-Tunnel) 2.0 where enabling Path MTU Discovery with DTLS failed to probe the path MTU correctly, causing packets to be silently dropped on lower-MTU paths.
Fixes an issue where the Zscaler Client Connector tray icon could be missing and traffic could go directly to the web after a device resumed from sleep if the tunnel started before the tray process.
Fixes an issue in Zscaler Tunnel (Z-Tunnel) 2.0 where transient read failures during TLS renegotiation with Zscaler proxy servers could trigger unnecessary failover to the secondary tunnel and cause unexpected disconnections.
Fixes an issue where single sign-on (SSO) failed and users were prompted to reauthenticate to Private Access when Zscaler Client Connector switched to Business Continuity mode while on a trusted network.

Zscaler Client Connector 4.9.0.481 Enhancements and Fixes

Tue, 29 Sep 2026 07:00:00 GMT

Fixes an issue where the app could crash after a Private Access connection reset while Zscaler Client Connector was clearing buffered data after the connection closed.
Fixes an issue where Zscaler Client Connector correctly used the PAC file entered for overriding protocol settings initially but then replaced it with the PAC file from the app profile.
Fixes a connectivity issue in Zscaler Tunnel (Z-Tunnel) 2.0 where enabling Path MTU Discovery with DTLS failed to probe the path MTU correctly, causing packets to be silently dropped on lower-MTU paths.
Fixes an issue where the Zscaler Client Connector tray icon could be missing and traffic could go directly to the web after a device resumed from sleep if the tunnel started before the tray process.
Fixes an issue where tray monitoring got stuck after a device entered sleep/hibernate mode, resulting in the app disappearing even though the Zscaler processes were still active.
Fixes an issue in Z-Tunnel 2.0 where transient read failures during TLS renegotiation with Zscaler proxy servers could trigger unnecessary failover to the secondary tunnel and cause unexpected disconnections.
Fixes an issue where single sign-on (SSO) failed and users were prompted to reauthenticate to Private Access when Zscaler Client Connector switched to Business Continuity mode while on a trusted network.

Zscaler Client Connector 5.0 Enhancements and Fixes

Tue, 29 Sep 2026 07:00:00 GMT

This version does not support Windows 32-bit. Zscaler recommends upgrading 32-bit to 64-bit. For help migrating to Windows 64-bit, refer to the Microsoft documentation. To learn more, see the trust post.

Modernizes Zscaler Client Connector to provide users with clear status and actionable, natural-language guidance, while keeping technical details within easy reach if they need to engage Zscaler Support.
Supports Wi-Fi Name (SSID) as a condition for trusted network criteria.
Supports choosing either Packet Monitor (Pktmon) or Npcap as a diagnostic tool for local packet capture.
Supports the TLS 1.3 protocol, and updates Zscaler Client Connector to automatically connect using TLS 1.3 and fall back to TLS 1.2 if the server doesn't support 1.3.
Supports an option in the app for the user to change the language in which the app displays to German.
Supports using machine tunnels in Business Continuity mode to allow devices to stay connected to Private Access apps when the Zscaler cloud is unreachable.
Supports using the WFP driver instead of Npcap when sending traceroute packets to Digital Experience.
Supports entering Business Continuity during enrollment if a user experiences authentication failures or network issues. To learn more, see Configuring Business Continuity.
Enhances Business Continuity to enter Business Continuity mode during enrollment when Zscaler Client Connector can't reach the Zscaler Admin Console. To learn more, see About Business Continuity.
Improves the user-switching process for Imprivata integration, eliminating downtime during user switches, to help achieve better interoperability with applications such as Epic Systems. To learn more, see Zscaler Client Connector and Imprivata Integration.
Supports using special formatting to add links and line breaks in end user notifications (EUNs) from Internet & SaaS. To learn more, see About Zscaler Client Connector-Based End User Notifications.
Supports Endpoint Data Loss Prevention (DLP) on ARM processor-based Windows machines when using the ZDP Module version 26.08 and later. To learn more, see About Endpoint Data Loss Prevention.
Supports using a Domain Public Key with the Business Continuity domain. To learn more, see Configuring Zscaler Client Connector App Profiles.
Enhances Internet & SaaS disaster recovery by supporting sending Zscaler Tunnel (Z-Tunnel) 2.0 traffic to the Business Continuity Cloud if Z-Tunnel 2.0 fails. To learn more, see Configuring Forwarding Profiles for Zscaler Client Connector.
Supports using the ind.zscalertwo.net subcloud in the cloudName installation parameter for Zscaler Client Connector deployments in India.
Enables automatic installation of the endpoint software used with Endpoint AI Security through Zscaler Client Connector. To learn more, contact your Zscaler Account team.
Supports launching Zscaler Client Connector without waiting for the Windows desktop to display (which was prevented when another app such as Windows Autopilot occupied the full screen indefinitely) by adding an installation parameter to skip the requirement that the desktop be visible. To learn more, see Supported Parameters for Zscaler Client Connector for Windows.
Fixes an issue where Zscaler Client Connector disabled hardware offloading features in the LWF driver, even though Adapter Hardware Offloading was enabled.
Fixes an issue where traffic bypassed for URLs with hostnames greater than 64 characters resulted in truncated hostnames in Internet & SaaS logs when Flow Logging was enabled.
Fixes an issue where users couldn't change their Windows password while Zscaler Client Connector was connected over a machine tunnel in Strict Enforcement mode.
Fixes an issue where the private key could be exposed when using VPN (for Legacy Apps).
Fixes an issue where Zscaler Client Connector remained in a Restarting service status after users clicked Restart Service in the app.
Fixes an issue that caused intermittent DNS timeouts and sporadic connection instability for VPN traffic bypassed using process-based application bypasses.
Fixes an issue where Zscaler Client Connector failed to properly handle bursts of DNS requests, resulting in intermittent DNS failures and failures with Cisco ISE postures.
Fixes an issue where users received a Chaining Authentication Error message if a manual policy update happened at the same time as a periodic policy update until they resolved the issue by updating the policy or restarting the Zscaler service.
Updates the Enable DTLS Instability Detection and Fallback option to improve response time when falling back to TLS after DTLS performance deteriorates.
Fixes an issue with slow throughput that occurred when accessing an SMB (Server Message Block) file share through an app segment with the Double Encryption option enabled.
Fixes an issue where, when using Dynamic ZIA Service Edge Assignment, Zscaler Client Connector didn’t display a user notification that the Service Edge had switched if the switch happened before the dynamic probes detected the issue.
Fixes an issue where the Disable ZIA OTP, Disable ZPA OTP, and Logout OTP one-time passwords failed for customers using Authentication Service due to a server and app password mismatch that occurred after registration.
Fixes an issue where, when the forwarding profile wasn't set to Enforce Proxy, Zscaler Client Connector removed the system proxy after exiting the app.
Fixes an issue where captive portal detection failed on networks using captive portals that return chunked HTTP responses (uncommon on guest Wi-Fi).
Fixes an issue where Zscaler Client Connector remained in an On-Trusted Network after the device woke from standby or sleep mode, even if the network had changed.
Upgrades the version of SQLite used by Zscaler Client Connector to SQLite version 3.53.1.
Fixes an issue where Private Access reauthentication was delayed or displayed a blank login page when using WebView2 authentication.
Fixes an issue where captive portal detection failed when a device connected to a captive portal that redirected Zscaler Client Connector to an HTTPS site on a non-standard port or to a site with an atypical URL path (e.g., no leading slash).
Fixes an issue where users were prompted to reauthenticate Private Access even though Private Access was disabled on the network based on the network criteria.
Fixes an issue where IP inclusions weren't enforced after a device resumed from a multi-day sleep, resulting in internet traffic bypassing Internet & SaaS after switching network types.
Fixes an issue where, even if the Restore LWF Adapter Binding feature was enabled, Zscaler Client Connector didn't attempt to rebind the adapter if the initial attempt failed.
Updates the Enforce Secure PAC URLs feature to normalize HTTP URLs to HTTPS and to limit HTTP fallback.
Fixes an issue where, if Zscaler Client Connector is upgraded, there could be a delay in installing the Zscaler Client Connector driver which could cause the system to enter an error state (display a blue screen) after the upgrade or system restart.
Fixes an issue where Zscaler Client Connector continuously tried re-registering Private Access if the first attempt failed due to a SAML token request failure (e.g., an expired identity JWT) instead of retrying the token request.
Prevents memory corruption in the Private Access certificate timeout handler caused by race conditions. (CVE-2026-25687)
Fixes an issue where posture checks weren't evaluated correctly for a partner if the domain of the partner tenant is on a different cloud than the main tenant.
Fixes an issue when using an SCCM virtual adapter where a tunnel crash could occur after traffic forwarding for Private Access switched and the Send Location Hint to Client Connector option was enabled.
Fixes an issue with the fail-close, application bypass, block domain profile detection, and captive portal lockdown features that could cause a tunnel crash.
Fixes an issue where, in a no-default route environment, policy updates were sent directly instead of through the tunnel even though Tunnel Internal Client Connector Traffic was enabled.
Fixes an issue where Acceptable Use Policy (AUP) data was reset during Private Access reauthentication, resulting in Private Access entitlement being removed for multiple users.
Fixes an issue where notifications from the Zscaler Notification Framework were brought into focus even though the Bring Notification to Focus option was disabled.
Fixes an issue where the policy download for a partner tenant didn't include the Ignore Client Cert errors for Webview 2 value, leading to partner tenant reauthentication failures.
Fixes an issue where, for devices authenticating with an IdP as a Private Access app segment and using the machine tunnel on a network identified by Trusted Network Criteria, first-time enrollment failed during Private Access registration if the app profile had Business Continuity enabled.
Fixes an issue where, if the forwarding PAC file for the Off-Trusted Network wasn't reachable, Zscaler Client Connector applied the forwarding PAC file for the On-Trusted Network after switching from a trusted to untrusted network.
Fixes an issue where the Update App and Update Policy options on the More window in the app disappeared after activating and deactivating Business Continuity mode.
Fixes an issue where VPN Service Edge tunnel connections intermittently failed or dropped after logging off and then logging back in to Windows.
Updates the network detection process to treat network detection failures as being on an Off-Trusted Network to prevent devices from remaining in an On-Trusted Network state if DNS hostname resolution is delayed.
Fixes an issue where Zscaler Client Connector used weak cipher suites when performing the CRL check for the Client Certificate device posture check.
Fixes an issue where fragmented packet handling in Zscaler Client Connector could cause the tunnel service to become unresponsive and temporarily disrupt network connectivity.
Fixes an issue where users couldn’t access Private Access resources when the DNS responses, such as SRV (Service) records, were large and occasionally became fragmented.
Fixes an issue where file uploads using WinSCP (Windows Secure Copy) became progressively slower when connecting to an FTP-SFTP server using Private Access.
Fixes a Windows registry value to prevent unquoted service path enumeration.
Updates the ZEP installer that installs anti-tampering protection to mitigate a security vulnerability that could allow code injections.
Fixes an issue where Zscaler Client Connector continued to populate the username field in the IdP login with the SAM account name after customers updated the Username Format to use the User Principal Name.
Fixes an issue where, if customers had many trusted networks with hostname-based trusted network criteria, Zscaler Client Connector remained in a Connecting state due to resolving the same hostname individually for each trusted network.
Fixes an issue where Zscaler Client Connector displayed the default notification after a transaction was blocked by a Data Loss Prevention (DLP) policy rule instead of the notification from the DLP template.
Fixes an issue where endpoint activity wasn't detected if Endpoint Data Loss Prevention (DLP) was enabled for a user before the user enrolled in Zscaler Client Connector.
Fixes an issue where the Firewall device posture check failed if any firewall profile had been disabled by a GPO policy even if another profile was enabled.
Fixes high CPU usage due to an issue with captive portal detection that occurred when Zscaler Client Connector failed to resolve or connect through the local proxy.
Fixes an issue where Authentication Service users received an Inconsistency in user credentials is detected error when reauthenticating to Private Access.
Fixes an issue where Zscaler Client Connector could experience frequent disconnections on devices with another application that modifies OpenSSL environment variables when FIPS-compliant libraries are enabled.
Fixes an issue where Zscaler Client Connector remained in a Connecting state or the ZSATunnel process didn't start when running on AWS VDI environments using Windows Server 2019 or Windows Server 2022.
Fixes an issue where default Wi-Fi interface binding issues could occur after upgrading Zscaler Client Connector, resulting in an Endpoint FW/AV error.
Fixes an issue where Zscaler Client Connector showed the VPN Service Edge as connected even after a network disconnect.
Fixes an issue where users could not load their captive portal due to Zscaler Client Connector failing to detect the portal.
Fixes an issue where, after reauthentication to Private Access, the Zscaler Client Connector app icon could disappear until a service restart.
Fixes an issue where the app could crash after a Private Access connection reset while Zscaler Client Connector was clearing buffered data after the connection closed.
Fixes an issue where, after removing and then re-adding a network segment, the routing table wasn't updated, preventing the user from connecting to that segment until they restarted Zscaler Client Connector.
Fixes an issue where Zscaler Client Connector correctly used the PAC file entered for overriding protocol settings initially but then replaced it with the PAC file from the app profile.
Fixes an issue where the app displayed the partner tenant username as the signed-in user when a user added or logged in to a partner tenant after enrolling in the main tenant.
Fixes a connectivity issue in Z-Tunnel 2.0 where enabling Path MTU Discovery with DTLS failed to probe the path MTU correctly, causing packets to be silently dropped on lower-MTU paths.
Fixes an issue where the Zscaler Client Connector tray icon could be missing and traffic could go directly to the web after a device resumed from sleep if the tunnel started before the tray process.
Fixes an issue where tray monitoring got stuck after a device entered sleep/hibernate mode, resulting in the app disappearing even though the Zscaler processes were still active.
Fixes an issue in Z-Tunnel 2.0 where transient read failures during TLS renegotiation with Zscaler proxy servers could trigger unnecessary failover to the secondary tunnel and cause unexpected disconnections.
Fixes an issue where access to Microsoft 365 resources was blocked and a W365 blocked: Non-compliant machine message displayed due to an incorrect Firewall device posture check failure.

Zscaler Client Connector 4.7.0.382 Enhancements and Fixes

Mon, 28 Sep 2026 07:00:00 GMT

Fixes an issue where, if the Windows certificate store included an unsupported certificate, the app disappeared from the system tray and Zscaler Client Connector consumed excessive memory.
Fixes an issue where, after reauthentication to Private Access, the Zscaler Client Connector app icon could disappear until a service restart.
Fixes an issue where the app displayed the partner tenant username as the signed-in user when a user added or logged in to a partner tenant after enrolling in the main tenant.
Fixes a connectivity issue in Zscaler Tunnel (Z-Tunnel) 2.0 where enabling Path MTU Discovery with DTLS failed to probe the path MTU correctly, causing packets to be silently dropped on lower-MTU paths.

Zscaler Client Connector 4.8.0.312 Enhancements and Fixes

Mon, 28 Sep 2026 07:00:00 GMT

Fixes an issue where default Wi-Fi interface binding issues could occur after upgrading Zscaler Client Connector, resulting in an Endpoint FW/AV error.
Fixes an issue where users could not load their captive portal due to Zscaler Client Connector failing to detect the portal.
Fixes an issue where, if the Windows certificate store included an unsupported certificate, the app disappeared from the system tray and Zscaler Client Connector consumed excessive memory.
Fixes an issue where, after reauthentication to Private Access, the Zscaler Client Connector app icon could disappear until a service restart.
Fixes an issue where the app could crash after a Private Access connection reset while Zscaler Client Connector was clearing buffered data after the connection closed.
Fixes an issue where, after removing and then re-adding a network segment, the routing table wasn't updated, preventing the user from connecting to that segment until they restarted Zscaler Client Connector.
Fixes an issue where the app displayed the partner tenant username as the signed-in user when a user added or logged in to a partner tenant after enrolling in the main tenant.
Fixes a connectivity issue in Z-Tunnel 2.0 where enabling Path MTU Discovery with DTLS failed to probe the path MTU correctly, causing packets to be silently dropped on lower-MTU paths.
Fixes an issue where tray monitoring got stuck after a device entered sleep/hibernate mode, resulting in the app disappearing even though the Zscaler processes were still active.

Zscaler Client Connector 4.10.0.463 Enhancements and Fixes

Tue, 15 Sep 2026 07:00:00 GMT

Improves the user-switching process for Imprivata integration, eliminating downtime during user switches, to help achieve better interoperability with applications such as Epic Systems. To learn more, see Zscaler Client Connector and Imprivata Integration.
Supports Endpoint Data Loss Prevention (DLP) on ARM processor-based Windows machines when using the ZDP Module version 26.08 and later. To learn more, see About Endpoint Data Loss Prevention.
Supports launching Zscaler Client Connector without waiting for the Windows desktop to display (which was prevented when another app such as Windows Autopilot occupied the full screen indefinitely) by adding an installation parameter to skip the requirement that the desktop be visible. To learn more, see Supported Parameters for Zscaler Client Connector for Windows.

Zscaler Client Connector 4.7.0.376 Enhancements and Fixes

Mon, 31 Aug 2026 07:00:00 GMT

Fixes an issue where, in a no-default route environment with an explicit external proxy, users could receive an Internet Unreachable or Server Down error when accessing Zscaler Client Connector through a machine tunnel.
Fixes an issue where the policy download for a partner tenant didn't include the Ignore Client Cert errors for Webview 2 value, leading to partner tenant reauthentication failures.
Fixes an issue where endpoint activity wasn't detected if Endpoint Data Loss Protection (DLP) was enabled for a user before the user enrolled in Zscaler Client Connector.
Fixes an issue where Authentication Service users received an Inconsistency in user credentials is detected error when reauthenticating to Private Access.
Fixes an issue where Zscaler Client Connector didn’t send the platform variable to Private Access for Authentication Service tenants, causing issues with policies based on the platform and with App Scaling.
Fixes an issue where Zscaler Client Connector didn't connect to the VPN Service Edge after the device woke from sleep until users clicked Restart Service in the app.
Fixes an issue where some applications could load slowly due to Zscaler Client Connector delays when rejecting invalid requests to the loopback proxy server.

Zscaler Client Connector 4.8.0.300 Enhancements and Fixes

Mon, 31 Aug 2026 07:00:00 GMT

Fixes an issue where Zscaler Client Connector remained in a Restarting service status after users clicked Restart Service in the app.
Fixes an issue where, in a no-default route environment with an explicit external proxy, users could receive an Internet Unreachable or Server Down error when accessing Zscaler Client Connector through a machine tunnel.
Fixes an issue where the policy download for a partner tenant didn't include the Ignore Client Cert errors for Webview 2 value, leading to partner tenant reauthentication failures.
Fixes an issue where endpoint activity wasn't detected if Endpoint Data Loss Protection (DLP) was enabled for a user before the user enrolled in Zscaler Client Connector.
Fixes an issue where Authentication Service users received an Inconsistency in user credentials is detected error when reauthenticating to Private Access.
Fixes an issue where Zscaler Client Connector didn't connect to the VPN Service Edge after the device woke from sleep until users clicked Restart Service in the app.
Fixes an issue where Zscaler Client Connector showed the VPN Service Edge as connected even after a network disconnect.
Fixes an issue where Zscaler Client Connector didn't send updated host details after a customer migrated their virtual machines (VMs) to another VDI vendor, causing the Device Details section on the Zscaler Client Connector Registered Device Details window to display outdated information.
Fixes an issue where some applications could load slowly due to Zscaler Client Connector delays when rejecting invalid requests to the loopback proxy server.

Zscaler Client Connector 4.9.0.465 Enhancements and Fixes

Mon, 31 Aug 2026 07:00:00 GMT

Fixes an issue where Zscaler Client Connector remained in a Restarting service status after users clicked Restart Service in the app.
Fixes an issue where, in a no-default route environment with an explicit external proxy, users could receive an Internet Unreachable or Server Down error when accessing Zscaler Client Connector through a machine tunnel.
Fixes an issue where the policy download for a partner tenant didn't include the Ignore Client Cert errors for Webview 2 value, leading to partner tenant reauthentication failures.
Fixes an issue where Zscaler Client Connector continued to populate the username field in the IdP login with the SAM account name after customers updated the Username Format to use the User Principal Name.
Fixes an issue where, if customers had many trusted networks with hostname-based trusted network criteria, Zscaler Client Connector remained in a Connecting state due to resolving the same hostname individually for each trusted network.
Fixes an issue where endpoint activity wasn't detected if Endpoint Data Loss Protection (DLP) was enabled for a user before the user enrolled in Zscaler Client Connector.
Fixes an issue where Authentication Service users received an Inconsistency in user credentials is detected error when reauthenticating to Private Access.
Fixes an issue where Zscaler Client Connector could experience frequent disconnections on devices with another application that modifies OpenSSL environment variables when FIPS-compliant libraries are enabled.
Fixes an issue where Zscaler Client Connector didn't connect to the VPN Service Edge after the device woke from sleep until users clicked Restart Service in the app.
Fixes an issue where VDI (virtual desktop infrastructures) users couldn't re-enroll in Zscaler Client Connector after performing a hardware migration on the VDI because Zscaler Client Connector didn't restore the original system proxy settings even though the Cache System Proxy on Startup option was enabled.
Fixes an issue where Zscaler Client Connector remained in a Connecting state or the ZSATunnel process didn't start when running on AWS VDI environments using Windows Server 2019 or Windows Server 2022.
Fixes an issue where Zscaler Client Connector showed the VPN Service Edge as connected even after a network disconnect.
Fixes an issue where Zscaler Client Connector didn't send updated host details after a customer migrated their virtual machines (VMs) to another VDI vendor, causing the Device Details section on the Zscaler Client Connector Registered Device Details window to display outdated information.
Fixes an issue where some applications could load slowly due to Zscaler Client Connector delays when rejecting invalid requests to the loopback proxy server.
Fixes an issue where, if the Windows certificate store included an unsupported certificate, the app disappeared from the system tray and Zscaler Client Connector consumed excessive memory.

Zscaler Client Connector 4.10 Enhancements and Fixes

Fri, 14 Aug 2026 07:00:00 GMT

Enables automatic installation of the endpoint software used with Endpoint AI Security through Zscaler Client Connector. To learn more, contact your Zscaler Account team.

Zscaler Client Connector 4.8.0.291 Enhancements and Fixes

Fri, 14 Aug 2026 07:00:00 GMT

Updates the Zscaler Client Connector installer to include mitigation logic (previously released in a separate tool) to address upgrades to this version from earlier versions that were affected by the rare timing-dependent conditions that could cause a Windows system crash (blue screen).
Fixes high CPU usage due to an issue with captive portal detection that occurred when Zscaler Client Connector failed to resolve or connect through the local proxy.
Fixes an issue where Zscaler Client Connector didn’t send the platform variable to Private Access for Authentication Service tenants, causing issues with policies based on the platform and with App Scaling.

Zscaler Client Connector 4.9.0.455 Enhancements and Fixes

Fri, 14 Aug 2026 07:00:00 GMT

Updates the Zscaler Client Connector installer to include mitigation logic (previously released in a separate tool) to address upgrades to this version from earlier versions that were affected by the rare timing-dependent conditions that could cause a Windows system crash (blue screen).
Fixes an issue where the Firewall device posture check failed if any firewall profile had been disabled by a GPO policy even if another profile was enabled.
Fixes high CPU usage due to an issue with captive portal detection that occurred when Zscaler Client Connector failed to resolve or connect through the local proxy.
Fixes an issue where Zscaler Client Connector didn’t send the platform variable to Private Access for Authentication Service tenants, causing issues with policies based on the platform and with App Scaling.

Zscaler Client Connector 4.7.0.364 Enhancements and Fixes

Mon, 03 Aug 2026 07:00:00 GMT

Supports using the ind.zscalertwo.net subcloud in the cloudName installation parameter for Zscaler Client Connector deployments in India.
Fixes an issue where Private Access reauthentication was delayed or displayed a blank login page when using WebView2 authentication.
Fixes an issue where Zscaler Client Connector continuously tried re-registering Private Access if the first attempt failed due to a SAML token request failure (e.g., an expired identity JWT) instead of retrying the token request.
Fixes an issue where, if Block All Inbound Traffic was enabled, Zscaler Client Connector blocked loopback traffic.
Fixes an issue where, if Lockdown on Firewall Error was enabled and Zscaler Client Connector went into network lockdown, Zscaler Client Connector still blocked access after switching to a trusted network that did not require lockdown.
Updates the ZEP (Zscaler Endpoint Protection) installer that installs anti-tampering protection to mitigate a security vulnerability that could allow code injections.
Fixes an issue where DNS traffic could loop when using F5 VPN and Zscaler Client Connector over Zscaler Tunnel (Z-Tunnel) 2.0 concurrently even when the F5 DNS process (F5FltSrv.exe) was added to the process-based bypass list.
Fixes an issue that caused some DNS requests to bypass the Zscaler Tunnel (Z-Tunnel) after reusing a UDP source port from a prior TCP connection.
Fixes an issue where the installation process could fail when installing Zscaler Client Connector with anti-tampering through the CLI, leaving the app partially installed and resulting in errors when trying to uninstall the app.
Fixes a port mismatch that caused a connection problem between Zscaler Client Connector and the device, resulting in incorrect Digital Experience (ZDX) data for the user.

Zscaler Client Connector 4.8.0.284 Enhancements and Fixes

Mon, 03 Aug 2026 07:00:00 GMT

Supports using the ind.zscalertwo.net subcloud in the cloudName installation parameter for Zscaler Client Connector deployments in India.
Fixes an issue where Private Access reauthentication was delayed or displayed a blank login page when using WebView2 authentication.
Fixes an issue where Zscaler Client Connector continuously tried re-registering Private Access if the first attempt failed due to a SAML token request failure (e.g., an expired identity JWT) instead of retrying the token request.
Fixes an issue where notifications from the Zscaler Notification Framework were brought into focus even though the Bring Notification to Focus option was disabled.
Fixes an issue where, if Block All Inbound Traffic was enabled, Zscaler Client Connector blocked loopback traffic.
Fixes an issue where, if Lockdown on Firewall Error was enabled and Zscaler Client Connector went into network lockdown, Zscaler Client Connector still blocked access after switching to a trusted network that did not require lockdown.
Updates the ZEP (Zscaler Endpoint Protection) installer that installs anti-tampering protection to mitigate a security vulnerability that could allow code injections.
Fixes an issue where file uploads using WinSCP (Windows Secure Copy) became progressively slower when connecting to an FTP-SFTP server using Private Access.
Fixes an issue that caused some DNS requests to bypass the Zscaler Tunnel (Z-Tunnel) after reusing a UDP source port from a prior TCP connection.
Fixes an issue where the installation process could fail when installing Zscaler Client Connector with anti-tampering through the CLI, leaving the app partially installed and resulting in errors when trying to uninstall the app.
Fixes an issue where, after switching from a machine tunnel to a user tunnel, access to Private Access applications was denied due to a timing issue that prevented successful posture results from being delivered.
Fixes a port mismatch that caused a connection problem between Zscaler Client Connector and the device, resulting in incorrect Digital Experience (ZDX) data for the user.
Fixes an issue where Zscaler Client Connector displayed the default notification after a transaction was blocked by a Data Loss Prevention (DLP) policy rule instead of the notification from the DLP template.

Zscaler Client Connector 4.9.0.448 Enhancements and Fixes

Mon, 03 Aug 2026 07:00:00 GMT

Supports using the ind.zscalertwo.net subcloud in the cloudName installation parameter for Zscaler Client Connector deployments in India.
Fixes an issue where Private Access reauthentication was delayed or displayed a blank login page when using WebView2 authentication.
Fixes an issue where Zscaler Client Connector continuously tried re-registering Private Access if the first attempt failed due to a SAML token request failure (e.g., an expired identity JWT) instead of retrying the token request.
Fixes an issue where notifications from the Zscaler Notification Framework were brought into focus even though the Bring Notification to Focus option was disabled.
Fixes an issue where, if Block All Inbound Traffic was enabled, Zscaler Client Connector blocked loopback traffic.
Fixes an issue where, if Lockdown on Firewall Error was enabled and Zscaler Client Connector went into network lockdown, Zscaler Client Connector still blocked access after switching to a trusted network that did not require lockdown.
Updates the ZEP (Zscaler Endpoint Protection) installer that installs anti-tampering protection to mitigate a security vulnerability that could allow code injections.
Fixes an issue where fragmented packet handling in Zscaler Client Connector could cause the tunnel service to become unresponsive and temporarily disrupt network connectivity.
Fixes an issue where users couldn’t access Private Access resources when the DNS responses, such as SRV (Service) records, were large and occasionally became fragmented.
Fixes an issue where file uploads using WinSCP (Windows Secure Copy) became progressively slower when connecting to an FTP-SFTP server using Private Access.
Fixes a Windows registry value to prevent unquoted service path enumeration.
Fixes an issue that caused some DNS requests to bypass the Zscaler Tunnel (Z-Tunnel) after reusing a UDP source port from a prior TCP connection.
Fixes an issue where DNS lookups could intermittently fail during failover to the secondary DNS server due to IPv6 behavior in the VPN (for Legacy Apps).
Fixes an issue where the installation process could fail when installing Zscaler Client Connector with anti-tampering through the CLI, leaving the app partially installed and resulting in errors when trying to uninstall the app.
Fixes an issue where, after switching from a machine tunnel to a user tunnel, access to Private Access applications was denied due to a timing issue that prevented successful posture results from being delivered.
Fixes a port mismatch that caused a connection problem between Zscaler Client Connector and the device, resulting in incorrect Digital Experience (ZDX) data for the user.
Fixes an issue where Zscaler Client Connector displayed the default notification after a transaction was blocked by a Data Loss Prevention (DLP) policy rule instead of the notification from the DLP template.

Zscaler Client Connector 4.8.0.267 Enhancements and Fixes

Wed, 01 Jul 2026 07:00:00 GMT

Fixes an issue when using an SCCM virtual adapter where DNS responses for Zscaler Private Access (ZPA) applications could be delayed after switching networks if the Send Location Hint to Client Connector option was enabled.
Fixes an issue where Zscaler Client Connector disabled hardware offloading features in the LWF driver, even though Adapter Hardware Offloading was enabled.
Fixes an issue where the Zscaler Client Connector filter driver interaction with the Wi-Fi Direct virtual adapter caused internet connectivity to drop when using Miracast screen mirroring.
Updates the network interface retrieval process for the LWF driver to clear temporary kernel buffer data to prevent data leakage.
Fixes an issue where users received a Chaining Authentication Error message if a manual policy update happened at the same time as a periodic policy update until they resolved the issue by updating the policy or restarting the Zscaler service.
Updates the Enable DTLS Instability Detection and Fallback option to improve response time when falling back to TLS after DTLS performance deteriorates.
Fixes an issue with slow throughput that occurred when accessing an SMB (Server Message Block) file share through an app segment with the Double Encryption option enabled.
Fixes an issue where the Disable ZIA OTP, Disable ZPA OTP, and Logout OTP one-time passwords failed for customers using Authentication Service due to a server and app password mismatch that occurred after registration.
Fixes an issue where, when the forwarding profile wasn't set to Enforce Proxy, Zscaler Client Connector removed the system proxy after exiting the app.
Fixes an issue where Zscaler Client Connector remained in an On-Trusted Network after the device woke from standby or sleep mode, even if the network had changed.
Upgrades the version of SQLite used by Zscaler Client Connector to SQLite version 3.53.1.
Fixes an issue where users were prompted to reauthenticate ZPA even though ZPA was disabled on the network based on the network criteria.
Updates the Enforce Secure PAC URLs feature to normalize HTTP URLs to HTTPS and to limit HTTP fallback.
Fixes an issue in the ZPA tunnel which could lead to a race condition. (CVE-2026-25687)
Fixes an issue where traffic was temporarily sent to the gateway domain after Zscaler Tunnel (Z-Tunnel) 2.0 startup instead of the proxy in the forwarding PAC file.
Fixes an issue where posture checks weren’t evaluated correctly for a partner if the domain of the partner tenant is on a different cloud than the main tenant.
Fixes duplicate requests that could cause a There was an error starting Private Access error message after a logged-in partner tenant exited and relaunched the app.
Fixes an issue where, when switching from a LAN to Wi-Fi or between Wi-Fi networks, Zscaler Client Connector incorrectly entered a ServerDown state which could cause traffic to briefly go direct if the forwarding profile or fail-open settings are set to not block traffic if the Service Edge isn't reachable.
Fixes an issue when using an SCCM virtual adapter where a tunnel crash could occur after traffic forwarding for ZPA switched and the Send Location Hint to Client Connector option was enabled.
Fixes an issue where the Client Certificate device posture check wasn’t evaluated correctly for a partner tenant.
Fixes an issue where Zscaler Client Connector didn’t apply the Block All Inbound Traffic firewall settings correctly after a policy update.
Fixes an issue with the fail-close, application bypass, block domain profile detection, and captive portal lockdown features that could cause a tunnel crash.
Fixes an issue where, if the primary DNS server returned NXDOMAIN (Non-Existent Domain) and the secondary DNS server failed, Zscaler Client Connector stayed on an On-Trusted Network and didn't switch to an Off-Trusted Network.
Fixes an issue where, in a no-default route environment, policy updates were sent directly instead of through the tunnel even though Tunnel Internal Client Connector Traffic was enabled.
Fixes an issue where Acceptable Use Policy (AUP) data was reset during ZPA reauthentication, resulting in ZPA entitlement being removed for multiple users.
Fixes an issue where, for devices authenticating with an IdP as a ZPA app segment and using the machine tunnel on a network identified by Trusted Network Criteria, first-time enrollment failed during ZPA registration if the app profile had business continuity enabled.
Fixes an issue where VPN Service Edge tunnel connections intermittently failed or dropped after logging off and then logging back in to Windows.
Updates the network detection process to treat network detection failures as being on an Off-Trusted Network to prevent devices from remaining in an On-Trusted Network state if DNS hostname resolution is delayed.

Zscaler Client Connector 4.6.0.486 Enhancements and Fixes

Tue, 30 Jun 2026 07:00:00 GMT

Fixes an issue where the Zscaler Client Connector filter driver interaction with the Wi-Fi Direct virtual adapter caused internet connectivity to drop when using Miracast screen mirroring.
Updates the network interface retrieval process for the LWF driver to clear temporary kernel buffer data to prevent data leakage.
Fixes an issue where users received a Chaining Authentication Error message if a manual policy update happened at the same time as a periodic policy update until they resolved the issue by updating the policy or restarting the Zscaler service.
Fixes an issue where, when using Dynamic ZIA Service Edge Assignment, Zscaler Client Connector didn’t display a user notification that the Service Edge had switched if the switch happened before the dynamic probes detected the issue.
Fixes an issue where the Disable ZIA OTP, Disable ZPA OTP, and Logout OTP one-time passwords failed for customers using Authentication Service due to a server and app password mismatch that occurred after registration.
Upgrades the version of SQLite used by Zscaler Client Connector to SQLite version 3.53.1.
Fixes an issue in the Zscaler Private Access (ZPA) tunnel which could lead to a race condition. (CVE-2026-25687)
Updates the Enforce Secure PAC URLs feature to normalize HTTP URLs to HTTPS and to limit HTTP fallback.
Fixes duplicate requests that could cause a There was an error starting Private Access error message after a logged-in partner tenant exited and relaunched the app.
Fixes an issue where the Client Certificate device posture check wasn’t evaluated correctly for a partner tenant.
Fixes an issue where, in a no-default route environment, policy updates were sent directly instead of through the tunnel even though Tunnel Internal Client Connector Traffic was enabled.
Fixes an issue where the Full Disk Encryption device posture check could pass while BitLocker protection was suspended on the device.
Fixes an issue where VPN Service Edge tunnel connections intermittently failed or dropped after logging off and then logging back in to Windows.

Zscaler Client Connector 4.7.0.350 Enhancements and Fixes

Tue, 30 Jun 2026 07:00:00 GMT

Fixes an issue when using an SCCM virtual adapter where DNS responses for Zscaler Private Access (ZPA) applications could be delayed after switching networks if the Send Location Hint to Client Connector option was enabled.
Fixes an issue where Zscaler Client Connector disabled hardware offloading features in the LWF driver, even though Adapter Hardware Offloading was enabled.
Fixes an issue where the Zscaler Client Connector filter driver interaction with the Wi-Fi Direct virtual adapter caused internet connectivity to drop when using Miracast screen mirroring.
Updates the network interface retrieval process for the LWF driver to clear temporary kernel buffer data to prevent data leakage.
Fixes an issue where the FIPS integrity check could fail for some components after installing Zscaler Client Connector, resulting in the app failing to start.
Fixes an issue where traffic for process-based application bypasses using Certificate Subject as a matching criterion wasn't bypassed and was sent through the tunnel.
Fixes an issue where, for users with an app profile with a notification template selected, the Show All Notifications and Show Private Access Reauthentication Notification settings on the More window in the app weren't reset to the default values from the notification template after upgrading.
Fixes an issue where Inline Web DLP and Endpoint DLP notifications weren't defined as critical, resulting in both notifications being suppressed for users with the Show notification pop-ups option disabled.
Fixes an issue where users received a Chaining Authentication Error message if a manual policy update happened at the same time as a periodic policy update until they resolved the issue by updating the policy or restarting the Zscaler service.
Fixes an issue with slow throughput that occurred when accessing an SMB (Server Message Block) file share through an app segment with the Double Encryption option enabled.
Fixes an issue where, when using Dynamic ZIA Service Edge Assignment, Zscaler Client Connector didn’t display a user notification that the Service Edge had switched if the switch happened before the dynamic probes detected the issue.
Fixes an issue where the Disable ZIA OTP, Disable ZPA OTP, and Logout OTP one-time passwords failed for customers using Authentication Service due to a server and app password mismatch that occurred after registration.
Fixes an issue where, when the forwarding profile wasn't set to Enforce Proxy, Zscaler Client Connector removed the system proxy after exiting the app.
Fixes an issue where Zscaler Client Connector remained in an On-Trusted Network after the device woke from standby or sleep mode, even if the network had changed.
Upgrades the version of SQLite used by Zscaler Client Connector to SQLite version 3.53.1.
Fixes an issue where users were prompted to reauthenticate ZPA even though ZPA was disabled on the network based on the network criteria.
Updates the Enforce Secure PAC URLs feature to normalize HTTP URLs to HTTPS and to limit HTTP fallback.
Fixes an issue in the ZPA tunnel which could lead to a race condition. (CVE-2026-25687)
Fixes an issue where traffic was temporarily sent to the gateway domain after Zscaler Tunnel (Z-Tunnel) 2.0 startup instead of the proxy in the forwarding PAC file.
Fixes an issue where posture checks weren’t evaluated correctly for a partner if the domain of the partner tenant is on a different cloud than the main tenant.
Fixes duplicate requests that could cause a There was an error starting Private Access error message after a logged-in partner tenant exited and relaunched the app.
Fixes an issue where, when switching from a LAN to Wi-Fi or between Wi-Fi networks, Zscaler Client Connector incorrectly entered a ServerDown state which could cause traffic to briefly go direct if the forwarding profile or fail-open settings are set to not block traffic if the Service Edge isn't reachable.
Fixes an issue when using an SCCM virtual adapter where a tunnel crash could occur after traffic forwarding for ZPA switched and the Send Location Hint to Client Connector option was enabled.
Fixes an issue where the Client Certificate device posture check wasn’t evaluated correctly for a partner tenant.
Fixes an issue where Zscaler Client Connector didn’t apply the Block All Inbound Traffic firewall settings correctly after a policy update.
Fixes an issue with the fail-close, application bypass, block domain profile detection, and captive portal lockdown features that could cause a tunnel crash.
Fixes an issue where, if the primary DNS server returned NXDOMAIN (Non-Existent Domain) and the secondary DNS server failed, Zscaler Client Connector stayed on an On-Trusted Network and didn't switch to an Off-Trusted Network.
Fixes an issue where, in a no-default route environment, policy updates were sent directly instead of through the tunnel even though Tunnel Internal Client Connector Traffic was enabled.
Fixes an issue where the Full Disk Encryption device posture check could pass while BitLocker protection was suspended on the device.
Fixes an issue where, for devices authenticating with an IdP as a ZPA app segment and using the machine tunnel on a network identified by Trusted Network Criteria, first-time enrollment failed during ZPA registration if the app profile had business continuity enabled.
Fixes an issue where VPN Service Edge tunnel connections intermittently failed or dropped after logging off and then logging back in to Windows.
Updates the network detection process to treat network detection failures as being on an Off-Trusted Network to prevent devices from remaining in an On-Trusted Network state if DNS hostname resolution is delayed.

Zscaler Client Connector 4.9.0.412 Enhancements and Fixes

Tue, 30 Jun 2026 07:00:00 GMT

Fixes an issue where Zscaler Client Connector disabled hardware offloading features in the LWF driver, even though Adapter Hardware Offloading was enabled.
Fixes an issue where the Zscaler Client Connector filter driver interaction with the Wi-Fi Direct virtual adapter caused internet connectivity to drop when using Miracast screen mirroring.
Fixes an intermittent issue where the LTE cellular adapter was disconnected after a driver upgrade during a Zscaler Client Connector upgrade and didn't reconnect until the user reset the adapter.
Fixes an issue where users received a Chaining Authentication Error message if a manual policy update happened at the same time as a periodic policy update until they resolved the issue by updating the policy or restarting the Zscaler service.
Updates the Enable DTLS Instability Detection and Fallback option to improve response time when falling back to TLS after DTLS performance deteriorates.
Fixes an issue with slow throughput that occurred when accessing an SMB (Server Message Block) file share through an app segment with the Double Encryption option enabled.
Fixes an issue where the Disable ZIA OTP, Disable ZPA OTP, and Logout OTP one-time passwords failed for customers using Authentication Service due to a server and app password mismatch that occurred after registration.
Fixes an issue where, when the forwarding profile wasn't set to Enforce Proxy, Zscaler Client Connector removed the system proxy after exiting the app.
Fixes an issue where Zscaler Client Connector remained in an On-Trusted Network after the device woke from standby or sleep mode, even if the network had changed.
Upgrades the version of SQLite used by Zscaler Client Connector to SQLite version 3.53.1.
Fixes an issue where users were prompted to reauthenticate Zscaler Private Access (ZPA) even though ZPA was disabled on the network based on the network criteria.
Updates the Enforce Secure PAC URLs feature to normalize HTTP URLs to HTTPS and to limit HTTP fallback.
Fixes an issue in the ZPA tunnel which could lead to a race condition. (CVE-2026-25687)
Fixes an issue where traffic was temporarily sent to the gateway domain after Zscaler Tunnel (Z-Tunnel) 2.0 startup instead of the proxy in the forwarding PAC file.
Fixes an issue where posture checks weren’t evaluated correctly for a partner if the domain of the partner tenant is on a different cloud than the main tenant.
Fixes duplicate requests that could cause a There was an error starting Private Access error message after a logged-in partner tenant exited and relaunched the app.
Fixes an issue when using an SCCM virtual adapter where a tunnel crash could occur after traffic forwarding for ZPA switched and the Send Location Hint to Client Connector option was enabled.
Fixes an issue where the Client Certificate device posture check wasn’t evaluated correctly for a partner tenant.
Fixes an issue where Zscaler Client Connector didn’t apply the Block All Inbound Traffic firewall settings correctly after a policy update.
Fixes an issue with the fail-close, application bypass, block domain profile detection, and captive portal lockdown features that could cause a tunnel crash.
Fixes an issue where, if the primary DNS server returned NXDOMAIN (Non-Existent Domain) and the secondary DNS server failed, Zscaler Client Connector stayed on an On-Trusted Network and didn't switch to an Off-Trusted Network.
Fixes an issue where, in a no-default route environment, policy updates were sent directly instead of through the tunnel even though Tunnel Internal Client Connector Traffic was enabled.
Fixes an issue where Acceptable Use Policy (AUP) data was reset during ZPA reauthentication, resulting in ZPA entitlement being removed for multiple users.
Fixes an issue where, for devices authenticating with an IdP as a ZPA app segment and using the machine tunnel on a network identified by Trusted Network Criteria, first-time enrollment failed during ZPA registration if the app profile had business continuity enabled.
Fixes an issue where VPN Service Edge tunnel connections intermittently failed or dropped after logging off and then logging back in to Windows.
Updates the network detection process to treat network detection failures as being on an Off-Trusted Network to prevent devices from remaining in an On-Trusted Network state if DNS hostname resolution is delayed.

Zscaler Client Connector 4.6.0.457 Enhancements and Fixes

Mon, 01 Jun 2026 07:00:00 GMT

Fixes an authentication bypass issue for Zscaler Client Connector to Zscaler Client Connector Portal-only communications. (CVE-2026-59564)
Mitigates multiple remote code execution vulnerabilities. (CVE-2026-59568)
Fixes multiple vulnerabilities that allowed for local privilege escalation. (CVE-2026-59567)
Fixes a local and kernel denial-of-service attack vector. (CVE-2026-59565)
Fixes an issue where users couldn't change their Windows password while Zscaler Client Connector was connected over a machine tunnel in Strict Enforcement mode.
Fixes out-of-bound reads that could occur when parsing ClientHello messages, which could result in the ZSATunnel crashing.

Zscaler Client Connector 4.7.0.317 Enhancements and Fixes

Mon, 01 Jun 2026 07:00:00 GMT

Fixes an authentication bypass issue for Zscaler Client Connector to Zscaler Client Connector Portal-only communications. (CVE-2026-59564)
Mitigates multiple remote code execution vulnerabilities. (CVE-2026-59568)
Fixes multiple vulnerabilities that allowed for local privilege escalation. (CVE-2026-59567)
Fixes a local and kernel denial-of-service attack vector. (CVE-2026-59565)
Fixes an issue where, if Zscaler Client Connector is upgraded on a device with a Windows reboot pending (e.g., after a Windows update), there could be a delay in installing the Zscaler Client Connector driver which could cause the system to enter an error state (display a blue screen) after the upgrade or system restart.
Fixes an issue where traffic bypassed for URLs with hostnames greater than 64 characters resulted in truncated hostnames in Zscaler Internet Access (ZIA) logs when Flow Logging was enabled.
Fixes an issue where users couldn't change their Windows password while Zscaler Client Connector was connected over a machine tunnel in Strict Enforcement mode.
Updates the LWF driver so it can be accessed only by a local admin Windows user
Fixes an issue where domain profile detection failed after a Zscaler Private Access (ZPA) reauthentication timeout, leaving Windows Defender Firewall devices on the Public profile.
Fixes an issue where incorrect handling of DNS resolution over TCP for ZPA domains caused intermittent application access failures.
Fixes an issue that caused intermittent DNS timeouts and sporadic connection instability for VPN traffic bypassed using process-based application bypasses.
Fixes an issue where Zscaler Client Connector failed to properly handle bursts of DNS requests, resulting in intermittent DNS failures and failures with Cisco ISE postures.
Fixes an issue where a Windows driver change resulted in intermittent connectivity for devices with checksum offloading enabled in the network adapter settings.
Fixes an issue where, even if the Restore LWF Adapter Binding feature was enabled, Zscaler Client Connector didn't attempt to rebind the adapter if the initial attempt failed.

Zscaler Client Connector 4.8.0.232 Enhancements and Fixes

Mon, 01 Jun 2026 07:00:00 GMT

Fixes an authentication bypass issue for Zscaler Client Connector to Zscaler Client Connector Portal-only communications. (CVE-2026-59564)
Mitigates multiple remote code execution vulnerabilities. (CVE-2026-59568)
Fixes multiple vulnerabilities that allowed for local privilege escalation. (CVE-2026-59567)
Fixes a local and kernel denial-of-service attack vector. (CVE-2026-59565)
Fixes an issue where traffic bypassed for URLs with hostnames greater than 64 characters resulted in truncated hostnames in Zscaler Internet Access (ZIA) logs when Flow Logging was enabled.
Fixes an issue where users couldn't change their Windows password while Zscaler Client Connector was connected over a machine tunnel in Strict Enforcement mode.
Fixes an issue where domain profile detection failed after a Zscaler Private Access (ZPA) reauthentication timeout, leaving Windows Defender Firewall devices on the Public profile.
Fixes an issue where Zscaler Client Connector intermittently disconnected due to repeatedly restarting the tunnel.
Fixes an issue where incorrect handling of DNS resolution over TCP for ZPA domains caused intermittent application access failures.
Fixes an issue that caused intermittent DNS timeouts and sporadic connection instability for VPN traffic bypassed using process-based application bypasses.
Fixes an issue where Zscaler Client Connector failed to properly handle bursts of DNS requests, resulting in intermittent DNS failures and failures with Cisco ISE postures.
Fixes an issue where a Windows driver change resulted in intermittent connectivity for devices with checksum offloading enabled in the network adapter settings.
Fixes an issue where captive portal detection failed on networks using captive portals that return chunked HTTP responses (uncommon on guest Wi-Fi).
Fixes an issue where captive portal detection failed when a device connected to a captive portal that redirected Zscaler Client Connector to an HTTPS site on a non-standard port or to a site with an atypical URL path (e.g., no leading slash).
Fixes an issue where IP inclusions weren’t enforced after a device resumed from a multi-day sleep, resulting in internet traffic bypassing Zscaler Internet Access (ZIA) after switching network types.
Fixes an issue where, even if the Restore LWF Adapter Binding feature was enabled, Zscaler Client Connector didn't attempt to rebind the adapter if the initial attempt failed.

Zscaler Client Connector 4.9.0.372 Enhancements and Fixes

Mon, 01 Jun 2026 07:00:00 GMT

Fixes an authentication bypass issue for Zscaler Client Connector to Zscaler Client Connector Portal-only communications. (CVE-2026-59564)
Mitigates multiple remote code execution vulnerabilities. (CVE-2026-59568)
Fixes multiple vulnerabilities that allowed for local privilege escalation. (CVE-2026-59567)
Fixes a local and kernel denial-of-service attack vector. (CVE-2026-59565)
Fixes an issue where, if Zscaler Client Connector is upgraded on a device with a Windows reboot pending (e.g., after a Windows update), there could be a delay in installing the Zscaler Client Connector driver which could cause the system to enter an error state (display a blue screen) after the upgrade or system restart.
Fixes an issue where traffic bypassed for URLs with hostnames greater than 64 characters resulted in truncated hostnames in Zscaler Internet Access (ZIA) logs when Flow Logging was enabled.
Fixes an issue where users couldn't change their Windows password while Zscaler Client Connector was connected over a machine tunnel in Strict Enforcement mode.
Fixes an issue where domain profile detection failed after a Zscaler Private Access (ZPA) reauthentication timeout, leaving Windows Defender Firewall devices on the Public profile.
Fixes an issue where Zscaler Client Connector intermittently disconnected due to repeatedly restarting the tunnel.
Fixes an issue where incorrect handling of DNS resolution over TCP for ZPA domains caused intermittent application access failures.
Fixes an issue that caused intermittent DNS timeouts and sporadic connection instability for VPN traffic bypassed using process-based application bypasses.
Fixes an issue where Zscaler Client Connector failed to properly handle bursts of DNS requests, resulting in intermittent DNS failures and failures with Cisco ISE postures.
Fixes an issue where captive portal detection failed on networks using captive portals that return chunked HTTP responses (uncommon on guest Wi-Fi).
Fixes an issue where captive portal detection failed when a device connected to a captive portal that redirected Zscaler Client Connector to an HTTPS site on a non-standard port or to a site with an atypical URL path (e.g., no leading slash).
Fixes an issue where IP inclusions weren’t enforced after a device resumed from a multi-day sleep, resulting in internet traffic bypassing ZIA after switching network types.
Fixes an issue where, even if the Restore LWF Adapter Binding feature was enabled, Zscaler Client Connector didn't attempt to rebind the adapter if the initial attempt failed.

Zscaler Client Connector 4.8.0.190 Enhancements and Fixes

Wed, 13 May 2026 07:00:00 GMT

Fixes an issue where, if Zscaler Client Connector is upgraded on a device with a Windows reboot pending (e.g., after a Windows update), there could be a delay in installing the Zscaler Client Connector driver which could cause the system to enter an error state (display a blue screen) after the upgrade or system restart.

Zscaler Client Connector 4.7.0.248 Enhancements and Fixes

Fri, 01 May 2026 07:00:00 GMT

This version of Zscaler Client Connector has a known issue affecting the Zscaler Client Connector filter driver. In certain scenarios, the issue could cause the system to enter an error state (display a blue screen) during a Zscaler Client Connector upgrade or system startup. If you encounter this issue, contact Zscaler Support for assistance. The issue has been corrected on Zscaler Client Connector version 4.7.0.317.

Fixes an intermittent issue where the LTE cellular adapter was disconnected after a driver upgrade during a Zscaler Client Connector upgrade and didn't reconnect until the user reset the adapter.
Fixes an issue where Zscaler Private Access (ZPA) remained in an Authentication Required state after clicking Authenticate for a partner tenant when the tenant's ZPA re-registration was pending.
Fixes an issue where users received a Private Access is Connected notification in the Notifications window in the app in addition to the Private Access is Connected (Business Continuity mode) notification when in business continuity.
Fixes an issue where the Deception service didn't restart immediately after users logged out of and then logged back in to Zscaler Client Connector.
Fixes an issue where users received an invalid password error after entering the correct Exit Password if they logged out of Zscaler Client Connector before trying to exit the app.
Fixes an issue where users could experience a blue screen after uninstalling the Eggplant Functional application when anti-tampering was enabled.
Fixes an issue where Endpoint Data Loss Prevention (DLP) wasn't enabled after starting the Zscaler Client Connector app if a previous attempt to uninstall Zscaler Client Connector didn't finish correctly.

Zscaler Client Connector 4.8.0.172 Enhancements and Fixes

Fri, 01 May 2026 07:00:00 GMT

Fixes an intermittent issue where the LTE cellular adapter was disconnected after a driver upgrade during a Zscaler Client Connector upgrade and didn't reconnect until the user reset the adapter.
Fixes an issue where Zscaler Private Access (ZPA) remained in an Authentication Required state after clicking Authenticate for a partner tenant when the tenant's ZPA re-registration was pending.
Fixes an issue where users received a Private Access is Connected notification in the Notifications window in the app in addition to the Private Access is Connected (Business Continuity mode) notification when in business continuity.
Fixes an issue where, for users with an app profile with a notification template selected, the Show All Notifications and Show Private Access Reauthentication Notification settings on the More window in the app weren't reset to the default values from the notification template after upgrading.
Fixes an issue where Inline Web DLP and Endpoint DLP notifications weren't defined as critical, resulting in both notifications being suppressed for users with the Show notification pop-ups option disabled.
Fixes an issue where the Deception service didn't restart immediately after users logged out of and then logged back in to Zscaler Client Connector.
Fixes an issue where the original system proxy settings were not restored due to a crash when Cache System Proxy on Startup was enabled.
Fixes an issue where users could experience a blue screen after uninstalling the Eggplant Functional application when anti-tampering was enabled.
Fixes an issue where Endpoint Data Loss Prevention (DLP) wasn't enabled after starting the Zscaler Client Connector app if a previous attempt to uninstall Zscaler Client Connector didn't finish correctly.

Zscaler Client Connector 4.9.0.331 Enhancements and Fixes

Thu, 30 Apr 2026 07:00:00 GMT

Fixes an issue where Zscaler Client Connector didn't fail over to the secondary DNS server on the network segment if the device's network adapter had only one DNS server configured and the primary DNS server was unresponsive.

Zscaler Client Connector 4.6.0.418 Enhancements and Fixes

Wed, 29 Apr 2026 07:00:00 GMT

Fixes an issue where the Deception service didn't restart immediately after users logged out of and then logged back in to Zscaler Client Connector.
Fixes an issue where users received an invalid password error after entering the correct Exit Password if they logged out of Zscaler Client Connector before trying to exit the app.
Fixes an issue where users could experience a blue screen after uninstalling the Eggplant Functional application when anti-tampering was enabled.
Fixes an issue where Endpoint Data Loss Prevention (DLP) wasn't enabled after starting the Zscaler Client Connector app if a previous attempt to uninstall Zscaler Client Connector didn't finish correctly.

Zscaler Client Connector 4.9.0.330 Enhancements and Fixes

Tue, 21 Apr 2026 07:00:00 GMT

Fixes an issue where the original system proxy settings were not restored due to a crash when Cache System Proxy on Startup was enabled.
Fixes an issue where, for users with an app profile with a notification template selected, the Show All Notifications and Show Private Access Reauthentication Notification settings on the More window in the app weren't reset to the default values from the notification template after upgrading.
Fixes an issue where users could experience a blue screen after uninstalling the Eggplant Functional application when anti-tampering was enabled.
Fixes an issue where Inline Web DLP and Endpoint DLP notifications weren't defined as critical, resulting in both notifications being suppressed for users with the Show notification pop-ups option disabled.
Fixes an issue where Endpoint Data Loss Prevention (DLP) wasn't enabled after starting the Zscaler Client Connector app if a previous attempt to uninstall Zscaler Client Connector didn't finish correctly.
Fixes an issue where a Windows driver change resulted in intermittent connectivity for devices with checksum offloading enabled in the network adapter settings.
Fixes an LWF driver issue that could cause performance degradation when downloading over Zscaler Tunnel (Z-Tunnel) 2.0.

Zscaler Client Connector 4.7.0.239 Enhancements and Fixes

Tue, 07 Apr 2026 07:00:00 GMT

Fixes performance issues that occurred when accessing virtual machines if Hyper-V was enabled on the device.

Zscaler Client Connector 4.6.0.410 Enhancements and Fixes

Tue, 31 Mar 2026 07:00:00 GMT

Fixes performance issues that occurred when accessing virtual machines if Hyper-V was enabled on the device.
Fixes performance issues that occurred after enabling a Hyper-V external switch with a Wi-Fi adapter.
Fixes out-of-bound reads that could occur when parsing ClientHello messages, which could result in the ZSATunnel crashing.
Fixes a driver issue that could cause process-based bypasses, the Block Domain Profile Detection feature, the captive portal lockdown feature, and fail-close settings to work incorrectly.
Fixes a tunnel IP handling issue that caused the VPN (for Legacy Apps) feature to not work, resulting in a blank VPN Tunnel section on the Private Access window in the app.
Fixes an issue where Zscaler Client Connector didn't refresh the driver state after the device woke from sleep, causing the app to display a Driver Error even though it was connected to the Zscaler service.

Zscaler Client Connector 4.8.0.156 Enhancements and Fixes

Tue, 31 Mar 2026 07:00:00 GMT

Fixes performance issues that occurred when accessing virtual machines if Hyper-V was enabled on the device.
Fixes an issue where VPN Gateway Bypasses weren't updated after switching from the machine tunnel to the user tunnel.

Zscaler Client Connector 4.9 Enhancements and Fixes

Tue, 31 Mar 2026 07:00:00 GMT

Adds support for Zscaler Deception service entitlement for Authentication Service tenants.
Supports sending the network type for the Network Share, Printing, and Device Control channels when creating policy rules for Endpoint Data Loss Prevention (DLP). To learn more, see Configuring Endpoint DLP Policy Rules.
Supports tunneling Azure Private Link domains over Zscaler Private Access (ZPA) by extracting the CNAME records from the DNS response and matching it against Zscaler Private Access (ZPA) applications. To learn more, see Configuring Private Link Domains.
Supports always using the V8 JavaScript based PAC Parser regardless of the setting in a user’s app profile. This change is in support of deprecating the Legacy (SpiderMonkey-based) PAC parser.
If your organization has multiple versions of Zscaler Client Connector installed across devices, devices with versions 4.8 and earlier installed continue to use the PAC parser selected in the app profile.
Supports using a secondary DNS server as a backup in network segments configured for VPN (for Legacy Apps). To learn more, see Configuring Network Segments.
Supports immediate ZPA reauthentication after ZPA authentication expires due to an action selected in the Force ZPA authentication to expire option instead of waiting for the user’s next ZPA access attempt. To learn more, see Configuring Zscaler Client Connector App Profiles.
Supports delaying pop-up notifications for device posture failures after the user tunnel is established. To learn more, see Configuring Notification Templates for Zscaler Client Connector.
Supports selecting whether to send the UPN (User Principal Name) or the SAM (Security Account Manager) account name in the login_hint parameter used to automatically populate the username. To learn more, see Configuring Automatic Username Population for IdP Authentication.
Adds the ability to update some installation parameters using the CLI without having to reinstall Zscaler Client Connector. To learn more, see Interacting with Zscaler Client Connector Remotely.
Streamlines the end user experience of pop-up notifications by adding system tray options to pause notifications, rewording existing notifications for clarity, and removing unnecessary notifications. To learn more, see Using Zscaler Client Connector.
Supports blocking all traffic and allowing only PAC file exclusions when in strict enforcement mode. To learn more, see Configuring Zscaler Client Connector App Profiles.
Supports checking for specific software versions for the following device postures: Process Check, Detect Carbon Black, Detect CrowdStrike, Detect SentinelOne, and Detect Microsoft Defender. To learn more, see Configuring Device Posture Profiles.
Supports controlling how Zscaler Client Connector interacts with hardware offloading on network adapters to resolve compatibility issues. To learn more, see Configuring Zscaler Client Connector App Profiles.
Supports customizing the company logos and company name that displays on the app and in pop-up notifications. To learn more, see Customizing the Zscaler Client Connector Theme.
Fixes an issue where traffic was intermittently sent to the secondary Public Service Edge instead of the primary Public Service Edge after the device woke from sleep.
Fixes an issue where the Block Domain Profile Detection feature didn't correctly block domain profile detection when switching to a network type with the feature enabled if the policy also had process-based bypasses enabled.
Fixes an issue where the fail-close lockdown settings didn't apply along with captive portal lockdown if the policy also had process-based bypasses enabled.
Improves the retrial logic of the VPN (for Legacy Apps) client in cases where the VPN gateway port is unreachable.
Fixes an issue when using an SCCM virtual adapter where DNS responses could be delayed after switching networks if the Send Location Hint to Client Connector option was enabled.
Fixes an issue where Zscaler Client Connector continued to use DNS suffixes from ZPA even after switching to a network type with a forwarding mode of None.
Fixes an issue where Zscaler Client Connector incorrectly allowed fail-close settings on the app profile to control network lockdown even if the Install WFP Driver option was disabled.
Updates Zscaler Client Connector to monitor changes to the system-level proxy configuration and to enforce the Zscaler proxy settings based on the forwarding profile.
Fixes an issue where an Internal Error message displayed after users clicked Verify Now in the Zscaler Client Connector app for step-up authentication for customers using the ZPA service and not the Zscaler Internet Access (ZIA) service.
Fixes an issue where, even if the device posture for posture-based service entitlement passed, ZIA was not enabled after enrollment if the user's app profile had Business Continuity enabled.
Adds support for using registry keys with the REG_BINARY type with the Registry Key device posture profile.
Fixes an issue where Zscaler Client Connector couldn't retrieve the PAC file when the source was the HKEY_CURRENT_USER Registry location provided in the forwarding profile.
Fixes an issue where Zscaler Client Connector bypassed non-DNS requests on port 53.
Fixes an issue where trusted network detection using the hostname and IP address criteria could cause a delay in switching between networks when using Zscaler Tunnel (Z-Tunnel) 2.0.
Fixes an issue where the app didn't display a device posture failure notification from ZPA if the Enable ZIA Notifications option was disabled.
Fixes a tunnel crash that occurred after upgrading which resulted in Zscaler Client Connector remaining in a Connecting state.
Fixes an issue where DNS requests for domains added in the Domain Inclusions field in App Profiles were bypassed instead of being routed through Z-Tunnel 2.0 on IPv4-only (non-dual stack) networks.
Fixes a timing issue that caused a delay in Zscaler Client Connector bypassing a URL after it was added to the app profile PAC file.
Fixes an issue where Zscaler Client Connector didn’t bypass process-based applications with an environment variable (e.g., %LocalAppData%) in the application path.
Fixes a timing issue where the custom app profile PAC file was not processed in time at startup, causing traffic to be forced through the default gateway domain without applying relevant bypasses and rules of the PAC file.
Mitigates a vulnerability where specific session timeout conditions allowed for the bypass of application exit protections. (CVSS v3.1 Base Score: 3.2 - Low)
Fixes an issue where traffic to a domain bypassed in the PAC file could be sent to the Zscaler service when an internal Health Check port was reused by another application.
Fixes an issue where, if the forwarding profile was set to bypass DNS traffic on a trusted network and send the traffic to ZPA on an off-trusted network, network detection caused Zscaler Client Connector to send some DNS traffic to ZPA while on a trusted network.
Fixes an issue where, if automatic reauthentication failed, users received a timeout error when manually reauthenticating.
Fixes an issue where devices with the Domain Joined posture profile always passed the posture check, even if the domain name didn't match or the device wasn't domain joined.
Fixes an issue that caused an Internal Error message on the Data Protection window in the app for customers using Endpoint Data Loss Prevention (DLP).
Updates the anti-tampering installation files to add protection to Endpoint Data Loss Prevention (DLP) internal files.
Fixes an issue where a trusted network defined by the Hostname and IP condition wasn't detected because the Zscaler Client Connector response included both the CName and the ipaddress in the response.
Fixes an issue where the Zscaler proxy wasn't enforced in accordance with the forwarding profile when the profile was set to Enforce Proxy.
Fixes an issue where the policy download might not occur immediately after upgrading Zscaler Client Connector, resulting in the app displaying in French if the system language was set to French but the Client Connector UI Language Settings was set to English.
Fixes an issue that could cause FW/AV errors on Windows 11 due to an accumulation of App Container loopback exemptions when the Disable Loopback Restriction option was enabled.
Fixes an issue where confirmation messages from DLP were delayed or not displayed.
Fixes a DNS routing issue that caused connectivity problems for applications accessed over VPN (for Legacy Apps) on a trusted network when the DNS server was defined as an app segment.
Fixes an issue where Zscaler Client Connector could bypass traffic on ports 53 and 67.
Fixes an issue where the Reauthenticate before your access expires notification displayed for users on an On-Trusted Network with ZPA disabled.
Fixes out-of-bound reads that could occur when parsing ClientHello messages, which could result in the ZSATunnel crashing.
Fixes inconsistent behavior where, when reconnecting to a ZPA application through an app segment with the Double Encryption option enabled, Zscaler Client Connector closed the app client connection immediately instead of holding the connections as it does when the option is disabled.
Mitigates a vulnerability where specific path validation conditions allowed for elevated write privileges. (CVSS v3.1 Base Score: 6.1 - Medium)
Fixes an issue where, when using the packet filter-based driver, Zscaler Client Connector added a route for 100.64.0.2 when ZPA connected but did not delete it when ZPA was turned off, which sometimes caused problems with domain profile detection.
Fixes an issue where, if the Default Outbound Firewall Rule was set to Firewall Allow in the Zscaler Endpoint Firewall config and Block Domain Profile Detection was enabled for any network type, the domain profile detection traffic wasn't blocked as expected after a network change.
Fixes a driver issue that could cause process-based bypasses, the Block Domain Profile Detection feature, the captive portal lockdown settings, and fail-close settings to work incorrectly.
Fixes an issue where, if Automatic ZPA Reauthentication was enabled and auto reauthentication was initiated after the device woke from sleep, users had to attempt a manual authentication and received a timeout error.
Fixes an issue where, after an application retried DNS requests using the same source port (e.g., due to heavy load or ZPA evaluation), a subsequent DNS request using that source port could be bypassed.
Fixes a tunnel IP handling issue that caused the VPN (for Legacy Apps) feature to not work, resulting in a blank VPN Tunnel section on the Private Access window in the app.
Fixes an issue where Zscaler Client Connector didn't refresh the driver state after the device woke from sleep, causing the app to display a Driver Error even though it was connected to the Zscaler service.

Zscaler Client Connector 4.7.0.232 Enhancements and Fixes

Tue, 17 Mar 2026 07:00:00 GMT

Fixes performance issues that occurred after enabling Hyper-V and creating an external switch with a Wi-Fi adapter.
Fixes ZSATunnel crash issues that could occur when parsing ClientHello messages.
Fixes a driver issue that could cause the process-based bypass feature, the Block Domain Profile Detection feature, the captive portal lockdown feature, and fail-close settings to work incorrectly.
Fixes a tunnel IP handling issue that caused the VPN (for Legacy Apps) feature to not work, resulting in a blank VPN Tunnel section on the Private Access window in the app.
Fixes an issue where Zscaler Client Connector didn't refresh the driver state after the device woke from sleep, causing the app to display a Driver Error even though it was connected to the Zscaler service.

Zscaler Client Connector 4.8.0.151 Enhancements and Fixes

Tue, 17 Mar 2026 07:00:00 GMT

Fixes performance issues that occurred after enabling Hyper-V and creating an external switch with a Wi-Fi adapter.
Fixes ZSATunnel crash issues that could occur when parsing ClientHello messages.
Fixes an issue where, if the Default Outbound Firewall Rule was set to Firewall Allow in the Zscaler Endpoint Firewall config and Block Domain Profile Detection was enabled for any network type, the Block Domain Profile Detection feature was broken.
Fixes a driver issue that could cause the process-based bypass feature, the Block Domain Profile Detection feature, the captive portal lockdown feature, and fail-close settings to work incorrectly.
Fixes an issue where, if Automatic ZPA Reauthentication was enabled and auto reauthentication was initiated after the device woke from sleep, users received a timeout error and had to attempt manual authentication.
Fixes an issue where DNS requests could be bypassed if, during periods of heavy loading such as connecting to Zscaler Private Access (ZPA), an application retried the requests using the same source port.
Fixes a tunnel IP handling issue that caused the VPN (for Legacy Apps) feature to not work, resulting in a blank VPN Tunnel section on the Private Access window in the app.
Fixes an issue where Zscaler Client Connector didn't refresh the driver state after the device woke from sleep, causing the app to display a Driver Error even though it was connected to the Zscaler service.

Zscaler Client Connector 4.6.0.398 Enhancements and Fixes

Fri, 27 Feb 2026 08:00:00 GMT

Supports controlling how Zscaler Client Connector interacts with hardware offloading on network adapters to resolve compatibility issues. To learn more, see Configuring Zscaler Client Connector App Profiles.
Fixes an issue where Zscaler Client Connector didn’t bypass process-based applications with an environment variable (e.g., %LocalAppData%) in the application path.
Fixes an issue where, if the forwarding profile was set to bypass DNS traffic on a trusted network and send the traffic to Zscaler Private Access (ZPA) on an off-trusted network, network detection caused Zscaler Client Connector to send some DNS traffic to ZPA while on a trusted network.
Fixes a DNS routing issue that caused connectivity problems for applications accessed over VPN (for Legacy Apps) on a trusted network when the DNS server was defined as an app segment.
Fixes an issue where the legacy SpiderMonkey-based PAC parser didn’t handle single quotations or backslashes correctly, which could result in traffic bypassing the local proxy.
Mitigates a vulnerability where specific path validation conditions allowed for elevated write privileges. (CVSS v3.1 Base Score: 6.1 - Medium)

Zscaler Client Connector 4.7.0.223 Enhancements and Fixes

Fri, 27 Feb 2026 08:00:00 GMT

Supports blocking all traffic and allowing only PAC file exclusions when in strict enforcement mode.
Supports controlling how Zscaler Client Connector interacts with hardware offloading on network adapters to resolve compatibility issues.
Fixes an issue where trusted network detection using the hostname and IP address criteria could cause a delay in switching between networks when using Zscaler Tunnel (Z-Tunnel) 2.0.
Fixes an issue where Zscaler Client Connector didn’t bypass process-based applications with an environment variable (e.g., %LocalAppData%) in the application path.
Mitigates a vulnerability where specific session timeout conditions allowed for the bypass of application exit protections. (CVSS v3.1 Base Score: 3.2 - Low)
Fixes an issue where, if the forwarding profile was set to bypass DNS traffic on a trusted network and send the traffic to Zscaler Private Access (ZPA) on an off-trusted network, network detection caused Zscaler Client Connector to send some DNS traffic to ZPA while on a trusted network.
Fixes a DNS routing issue that caused connectivity problems for applications accessed over VPN (for Legacy Apps) on a trusted network when the DNS server was defined as an app segment.
Fixes an issue where Zscaler Client Connector could bypass traffic on ports 53 and 67.
Fixes inconsistent behavior where, when reconnecting to a ZPA application through an app segment with the Double Encryption option enabled, Zscaler Client Connector closed the app client connection immediately instead of holding the connections as it does when the option is disabled.
Fixes an issue where the legacy SpiderMonkey-based PAC parser didn’t handle single quotations or backslashes correctly, which could result in traffic bypassing the local proxy.
Mitigates a vulnerability where specific path validation conditions allowed for elevated write privileges. (CVSS v3.1 Base Score: 6.1 - Medium)

Zscaler Client Connector 4.8.0.140 Enhancements and Fixes

Thu, 26 Feb 2026 08:00:00 GMT

Supports blocking all traffic and allowing only PAC file exclusions when in strict enforcement mode. To learn more, see Configuring Zscaler Client Connector App Profiles.
Supports controlling how Zscaler Client Connector interacts with hardware offloading on network adapters to resolve compatibility issues. To learn more, see Configuring Zscaler Client Connector App Profiles.
Fixes an issue where trusted network detection using the hostname and IP address criteria could cause a delay in switching between networks when using Zscaler Tunnel (Z-Tunnel) 2.0.
Fixes an issue where Zscaler Client Connector didn’t bypass process-based applications with an environment variable (e.g., %LocalAppData%) in the application path.
Mitigates a vulnerability where specific session timeout conditions allowed for the bypass of application exit protections. (CVSS v3.1 Base Score: 3.2 - Low)
Fixes an issue where, if the forwarding profile was set to bypass DNS traffic on a trusted network and send the traffic to Zscaler Private Access (ZPA) on an off-trusted network, network detection caused Zscaler Client Connector to send some DNS traffic to ZPA while on a trusted network.
Fixes a DNS routing issue that caused connectivity problems for applications accessed over VPN (for Legacy Apps) on a trusted network when the DNS server was defined as an app segment.
Fixes an issue where Zscaler Client Connector could bypass traffic on ports 53 and 67.
Fixes inconsistent behavior where, when reconnecting to a ZPA application through an app segment with the Double Encryption option enabled, Zscaler Client Connector closed the app client connection immediately instead of holding the connections as it does when the option is disabled.
Fixes an issue where the legacy SpiderMonkey-based PAC parser didn’t handle single quotations or backslashes correctly, which could result in traffic bypassing the local proxy.
Mitigates a vulnerability where specific path validation conditions allowed for elevated write privileges. (CVSS v3.1 Base Score: 6.1 - Medium)
Fixes an issue where, when using the packet filter-based driver, Zscaler Client Connector added a route for 100.64.0.2 when ZPA connected but did not delete it when ZPA was turned off, which sometimes caused problems with domain profile detection.

Zscaler Client Connector 4.6.0.371 Enhancements and Fixes

Fri, 30 Jan 2026 08:00:00 GMT

Supports controlling how Zscaler Client Connector interacts with the Receive Segment Coalescing (RSC) feature on network adapters to resolve compatibility issues. To learn more, see Configuring Zscaler Client Connector App Profiles.
Fixes an issue where the Block Domain Profile Detection feature didn't correctly block domain profile detection when switching to a network type with the feature enabled if the policy also had process-based bypasses enabled.
Fixes an issue where the Fail Close lockdown settings didn't apply along with captive portal lockdown if the policy also had process-based bypasses enabled.
Fixes a timing issue where the custom app profile PAC file was not processed in time at startup, causing traffic to be forced through the default gateway domain without applying the relevant bypasses and rules of the PAC file.
Fixes a proxy authentication issue (recalculation of the nonce value) where, if load balancing was used by the ISP, sites could fail to load when using Zscaler Tunnel (Z-Tunnel) 1.0.
Fixes an issue where traffic to a domain bypassed in the PAC file could be sent to the Zscaler service when an internal Health Check port was reused by another application.
Fixes an issue where Zscaler Client Connector didn't detect the captive portal when sending Zscaler Internet Access (ZIA) traffic through a proxy defined as a Zscaler Private Access (ZPA) application.
Fixes an issue where, if automatic reauthentication failed, users received a timeout error when manually reauthenticating.
Updates the process check for the Full Disk Encryption device posture to use a more reliable check, preventing incorrect encryption status results.
Fixes a delay when logging in to Windows when Zscaler Client Connector is in strict enforcement and machine tunnel mode.
Fixes an issue that caused an Internal Error message on the Data Protection window in the app for customers using Endpoint Data Loss Prevention (DLP).
Updates the anti-tampering installation files to add protection to Endpoint DLP internal files.
Fixes an issue where a trusted network defined by the Hostname and IP condition wasn't detected because the Zscaler Client Connector response included both the CName and the ipaddress in the response.
Fixes an issue where the Zscaler proxy wasn't enforced in accordance with the forwarding profile when the profile was set to Enforce Proxy.
Fixes an issue that could cause FW/AV errors on Windows 11 due to an accumulation of App Container loopback exemptions when the Disable Loopback Restriction option was enabled.

Zscaler Client Connector 4.7.0.202 Enhancements and Fixes

Fri, 30 Jan 2026 08:00:00 GMT

Supports controlling how Zscaler Client Connector interacts with the Receive Segment Coalescing (RSC) feature on network adapters to resolve compatibility issues. To learn more, see Configuring Zscaler Client Connector App Profiles.
Fixes an issue where the Block Domain Profile Detection feature didn't correctly block domain profile detection when switching to a network type with the feature enabled if the policy also had process-based bypasses enabled.
Fixes an issue where the Fail Close lockdown settings didn't apply along with captive portal lockdown if the policy also had process-based bypasses enabled.
Fixes an issue where an Internal Error message displayed after users clicked Verify Now in the Zscaler Client Connector app for step-up authentication for customers using the Zscaler Private Access (ZPA) service and not the Zscaler Internet Access (ZIA) service.
Fixes a timing issue where the custom app profile PAC file was not processed in time at startup, causing traffic to be forced through the default gateway domain without applying the relevant bypasses and rules of the PAC file.
Fixes a proxy authentication issue (recalculation of the nonce value) where, if load balancing was used by the ISP, sites could fail to load when using Zscaler Tunnel (Z-Tunnel) 1.0.
Fixes an issue where traffic to a domain bypassed in the PAC file could be sent to the Zscaler service when an internal Health Check port was reused by another application.
Fixes an issue where Zscaler Client Connector didn't detect the captive portal when sending ZIA traffic through a proxy defined as a ZPA application.
Fixes an issue with slow throughput that occurred when accessing an SMB (Server Message Block) file share through an app segment with the Double Encryption option enabled.
Fixes an issue where, if automatic reauthentication failed, users received a timeout error when manually reauthenticating.
Updates the process check for the Full Disk Encryption device posture to use a more reliable check, preventing incorrect encryption status results.
Fixes a delay when logging in to Windows when Zscaler Client Connector is in strict enforcement and machine tunnel mode.
Fixes an issue that caused an Internal Error message on the Data Protection window in the app for customers using Endpoint Data Loss Prevention (DLP).
Updates the anti-tampering installation files to add protection to Endpoint DLP internal files.
Fixes an issue where a trusted network defined by the Hostname and IP condition wasn't detected because the Zscaler Client Connector response included both the CName and the ipaddress in the response.
Fixes an issue where the Zscaler proxy wasn't enforced in accordance with the forwarding profile when the profile was set to Enforce Proxy.
Fixes an issue that could cause FW/AV errors on Windows 11 due to an accumulation of App Container loopback exemptions when the Disable Loopback Restriction option was enabled.

Zscaler Client Connector 4.8.0.115 Enhancements and Fixes

Fri, 30 Jan 2026 08:00:00 GMT

Supports controlling how Zscaler Client Connector interacts with the Receive Segment Coalescing (RSC) feature on network adapters to resolve compatibility issues. To learn more, see Configuring Zscaler Client Connector App Profiles.
Fixes an issue where devices with the Domain Joined posture profile always passed the posture check, even if the domain name didn't match or the device wasn't domain joined.
Fixes an issue where the Block Domain Profile Detection feature didn't correctly block domain profile detection when switching to a network type with the feature enabled if the policy also had process-based bypasses enabled.
Fixes an issue where the Fail Close lockdown settings didn't apply along with captive portal lockdown if the policy also had process-based bypasses enabled.
Fixes an issue where an Internal Error message displayed after users clicked Verify Now in the Zscaler Client Connector app for step-up authentication for customers using the Zscaler Private Access (ZPA) service and not the Zscaler Internet Access (ZIA) service.
Fixes a timing issue where the custom app profile PAC file was not processed in time at startup, causing traffic to be forced through the default gateway domain without applying the relevant bypasses and rules of the PAC file.
Fixes an issue where traffic to a domain bypassed in the PAC file could be sent to the Zscaler service when an internal Health Check port was reused by another application.
Fixes an issue where DLL files created by the installer during a Zscaler Client Connector installation or upgrade in the %temp% directory were blocked by Windows Defender Application Control (WDAC) by adding a system environment variable (BITROCK_TEMP_DLLS_FOLDER) that points to a specific path where the temporary DLLs are extracted. This path can be added to an allowlist of WDAC policies.
Fixes an issue where Zscaler Client Connector didn't detect the captive portal when sending ZIA traffic through a proxy defined as a ZPA application.
Fixes an issue with slow throughput that occurred when accessing an SMB (Server Message Block) file share through an app segment with the Double Encryption option enabled.
Fixes an issue where, if automatic reauthentication failed, users received a timeout error when manually reauthenticating.
Fixes an issue that caused an Internal Error message on the Data Protection window in the app for customers using Endpoint Data Loss Prevention (DLP).
Updates the anti-tampering installation files to add protection to Endpoint DLP internal files.
Fixes an issue where a trusted network defined by the Hostname and IP condition wasn't detected because the Zscaler Client Connector response included both the CName and the ipaddress in the response.
Fixes an issue where the Zscaler proxy wasn't enforced in accordance with the forwarding profile when the profile was set to Enforce Proxy.
Fixes an issue that could cause FW/AV errors on Windows 11 due to an accumulation of App Container loopback exemptions when the Disable Loopback Restriction option was enabled.