Client Connector App Release Summary (2026)

Zscaler Client Connector 5.0 Enhancements and Fixes

Thu, 01 Oct 2026 07:00:00 GMT

Supports immediately restarting Z-Tunnel 2.0 after a device wakes up from sleep regardless of the Reconnect Tunnel on System Wakeup setting in a user's app profile.
Supports excluding DNS servers from the routing table regardless of the setting in a user's app profile to improve DNS handling and remove reliance on macOS route injection for DNS bypass logic in Route-Based Traffic Interception mode.
Supports always bypassing DNS requests using the Zscaler Client Connector UDP proxy regardless of the setting in a user's app profile to improve DNS handling and provide a stable mechanism that is resilient to network changes to handle DNS exclusions without relying on changes in the host route table in Route-based Interception mode.
Supports processing DNS queries directly using Zscaler Client Connector's DNS traffic steering and skipping the internal local proxy server regardless of the setting in a user's app profile to help prevent FW/AV errors due to DNS processing conflicts with macOS Firewall.
Adds support to the Prioritize DNS Exclusions over Z-Tunnel 2.0 option in App Profiles to ensure that all DNS requests for domains in Domain Exclusions will not be tunneled through Internet & SaaS. To learn more, see Configuring Zscaler Client Connector App Profiles.
Supports displaying a customizable notification to end users who are blocked from a Private Access app due to a failed device posture. To learn more, see Configuring Device Posture Profiles and Configuring Notification Templates for Zscaler Client Connector.
Removes notification support through the macOS Notification Center for end user notifications. All end user notifications are now displayed using the Zscaler Notification Framework, which is enabled by default in Zscaler Client Connector.
Supports overriding legacy config.ini configurations with PLIST-based installation parameters.
Supports suppressing the message from Private Access that displays to users when a Private Access policy blocks access to an app. To learn more, see Configuring Access Policies.
Adds granularity to restrict Private Access partner logins to specify which partner tenants can access your organization's tenant.
Supports partner login settings on the app profile that can override the global Private Access Partner Logins settings (including entering specific partner domains that you can select on the app) and apply a device posture to partner tenants.
Modernizes Zscaler Client Connector to provide users with clear status and actionable, natural-language guidance, while keeping technical details within easy reach if they need to engage Zscaler Support.
Supports Trusted Network Criteria for new user enrollments with Business Continuity.
Supports Business Continuity mode for Authentication Service users.
Supports using machine tunnels in Business Continuity mode to allow devices to stay connected to Private Access apps when the Zscaler cloud is unreachable.
Supports enabling and disabling Internet & SaaS and Digital Experience remotely via CLI. To learn more, see Interacting with Zscaler Client Connector Remotely .
Adds the Server Validated Client Certificate posture type that validates the client certificate against the cloud rather than only checking locally for managed devices.
Removes support for the Using JavaScript option used to automatically populate the username in the IdP login page. Zscaler Client Connector will not use JavaScript regardless of the user setting in App Supportability. To learn more, see Configuring Automatic Username Population for IdP Authentication.
Adds support for login_hint SAML attributes to improve the Automatically Populate Username for IdP Authentication feature. To learn more, see Configuring Automatic Username Population for IdP Authentication.
Fixes an issue where Zscaler Client Connector incorrectly displayed disconnection and connection notifications when Strict Enforcement mode was active.

Zscaler Client Connector 4.10.0.36 Enhancements and Fixes

Wed, 30 Sep 2026 07:00:00 GMT

Supports using machine tunnels with Private Access (ZPA) apps when using Transparent Proxy-based Interception. To learn more, see Deploying Zscaler Client Connector with Jamf Pro for macOS, Deploying Zscaler Client Connector with Microsoft Intune for macOS, or Deploying Zscaler Client Connector with Workspace ONE UEM for macOS.
Fixes an issue where Zscaler Client Connector repeatedly disconnected and reconnected when the Add Ifscope Route option was enabled in the app profile in Route-based Traffic Interception mode.
Fixes an issue where Zscaler Client Connector ignored custom PAC URLs when Strict Enforcement mode was enabled while using machine tunnels in Route-based Traffic Interception mode.
Fixes an issue where users intermittently received a DNS_PROBE_FINISHED_NXDOMAIN error when trying to access existing external sites using Internet & SaaS in Transparent-based Proxy Interception Mode.
Fixes an issue where the Zscaler CLI was incorrectly reporting an authentication status of AUTHENTICATION_REQUIRED instead of REGISTRATION_REQUIRED.
Fixes an issue where Zscaler Client Connector failed to clear all cached Kerberos tickets when the Force Kerberos Ticket Refresh after Private Access Reauthentication option is enabled in the app profile, prompting unexpected reauthentication.
Fixes an issue where the Zscaler Client Connector returns false for all unsupported postures.
Fixes an issue where Zscaler Client Connector did not use the default browser when the app was installed with the externalRedirect installation parameter set to 1 and Authentication Browser Type under Platform Settings was set to Browser-Based Authentication with Default Browser enabled or to WebAuthn Popup Browser.
Fixes an issue where users were prompted to reauthenticate Private Access even though the Forwarding Profile Action for Private Access for the On-Trusted Network type was set to None.
Fixes an issue where users with Transparent Proxy-based Interception mode enabled could not access certain websites in Chromium-based browsers and via curl when the Custom IP-Based Application Bypass field configured in Zscaler Admin Console contained an empty string.
Fixes an issue where users could not load their captive portal due to Zscaler Client Connector failing to detect the portal.
Fixes an issue where Zscaler Client Connector reported an incorrect posture evaluation result for Jamf Trust and marked the device as noncompliant when the app's Apple App Store signing certificate has expired.
Fixes an issue where enrollment could fail with a Domain not Registered (3011) error when the Register device with ZPA IDP Username setting was enabled for customers who don't use Private Access.
Fixes an issue that resulted in FW/AV errors by adding the Process DNS Without Proxy Redirection option to change DNS processing logic. Zscaler recommends enabling this option when using Route-based Traffic Interception. To learn more, see Configuring Zscaler Client Connector App Profiles.

Zscaler Client Connector 4.5.2.372 Enhancements and Fixes

Wed, 30 Sep 2026 07:00:00 GMT

Supports using machine tunnels with Private Access (ZPA) apps when using Transparent Proxy-based Interception. To learn more, see Deploying Zscaler Client Connector with Jamf Pro for macOS, Deploying Zscaler Client Connector with Microsoft Intune for macOS, or Deploying Zscaler Client Connector with Workspace ONE UEM for macOS.
Fixes an issue where Zscaler Client Connector repeatedly disconnected and reconnected when the Add Ifscope Route option was enabled in the app profile in Route-based Traffic Interception mode.
Fixes an issue where Zscaler Client Connector ignored custom PAC URLs when Strict Enforcement mode was enabled while using machine tunnels in Route-based Traffic Interception mode.
Fixes an issue where users intermittently received a DNS_PROBE_FINISHED_NXDOMAIN error when trying to access existing external sites using Internet & SaaS in Transparent-based Proxy Interception Mode.
Fixes an issue where the Zscaler CLI was incorrectly reporting an authentication status of AUTHENTICATION_REQUIRED instead of REGISTRATION_REQUIRED.
Fixes an issue where the Zscaler Client Connector returns false for all unsupported postures.
Fixes an issue where users with Transparent Proxy-based Interception mode enabled could not access certain websites in Chromium-based browsers and via curl when the Custom IP-Based Application Bypass field configured in Zscaler Admin Console contained an empty string.
Fixes an issue where Zscaler Client Connector reported an incorrect posture evaluation result for Jamf Trust and marked the device as noncompliant when the app's Apple App Store signing certificate has expired.
Fixes an issue where enrollment could fail with a Domain not Registered (3011) error when the Register device with ZPA IDP Username setting was enabled for customers who don't use Private Access.
Fixes an issue that resulted in FW/AV errors by adding the Process DNS Without Proxy Redirection option to change DNS processing logic. Zscaler recommends enabling this option when using Route-based Traffic Interception. To learn more, see Configuring Zscaler Client Connector App Profiles.

Zscaler Client Connector 4.7.0.380 Enhancements and Fixes

Wed, 30 Sep 2026 07:00:00 GMT

Supports using machine tunnels with Private Access (ZPA) apps when using Transparent Proxy-based Interception. To learn more, see Deploying Zscaler Client Connector with Jamf Pro for macOS, Deploying Zscaler Client Connector with Microsoft Intune for macOS, or Deploying Zscaler Client Connector with Workspace ONE UEM for macOS.
Fixes an issue where Zscaler Client Connector repeatedly disconnected and reconnected when the Add Ifscope Route option was enabled in the app profile in Route-based Traffic Interception mode.
Fixes an issue where Zscaler Client Connector ignored custom PAC URLs when Strict Enforcement mode was enabled while using machine tunnels in Route-based Traffic Interception mode.
Fixes an issue where users intermittently received a DNS_PROBE_FINISHED_NXDOMAIN error when trying to access existing external sites using Internet & SaaS in Transparent-based Proxy Interception Mode.
Fixes an issue where the Zscaler CLI was incorrectly reporting an authentication status of AUTHENTICATION_REQUIRED instead of REGISTRATION_REQUIRED.
Fixes an issue where Zscaler Client Connector did not retain user configuration changes after app restart.
Fixes an issue where Zscaler Client Connector ignored user-configured PAC URLs when attempting to override settings locally.
Fixes an issue where the Zscaler Client Connector returns false for all unsupported postures.
Fixes an issue where Zscaler Client Connector did not use the default browser when the app was installed with the externalRedirect installation parameter set to 1 and Authentication Browser Type under Platform Settings was set to Browser-Based Authentication with Default Browser enabled or to WebAuthn Popup Browser.
Fixes an issue where users were prompted to reauthenticate Private Access even though the Forwarding Profile Action for Private Access for the On-Trusted Network type was set to None.
Fixes an issue where users with Transparent Proxy-based Interception mode enabled could not access certain websites in Chromium-based browsers and via curl when the Custom IP-Based Application Bypass field configured in Zscaler Admin Console contained an empty string.
Fixes an issue where users could not load their captive portal due to Zscaler Client Connector failing to detect the portal.
Fixes an issue where Zscaler Client Connector reported an incorrect posture evaluation result for Jamf Trust and marked the device as noncompliant when the app's Apple App Store signing certificate has expired.
Fixes an issue where enrollment could fail with a Domain not Registered (3011) error when the Register device with ZPA IDP Username setting was enabled for customers who don't use Private Access.
Fixes an issue that resulted in FW/AV errors by adding the Process DNS Without Proxy Redirection option to change DNS processing logic. Zscaler recommends enabling this option when using Route-based Traffic Interception. To learn more, see Configuring Zscaler Client Connector App Profiles.

Zscaler Client Connector 4.8.0.281 Enhancements and Fixes

Wed, 30 Sep 2026 07:00:00 GMT

Supports using machine tunnels with Private Access (ZPA) apps when using Transparent Proxy-based Interception. To learn more, see Deploying Zscaler Client Connector with Jamf Pro for macOS, Deploying Zscaler Client Connector with Microsoft Intune for macOS, or Deploying Zscaler Client Connector with Workspace ONE UEM for macOS.
Fixes an issue where Zscaler Client Connector repeatedly disconnected and reconnected when the Add Ifscope Route option was enabled in the app profile in Route-based Traffic Interception mode.
Fixes an issue where Zscaler Client Connector ignored custom PAC URLs when Strict Enforcement mode was enabled while using machine tunnels in Route-based Traffic Interception mode.
Fixes an issue where users intermittently received a DNS_PROBE_FINISHED_NXDOMAIN error when trying to access existing external sites using Internet & SaaS in Transparent-based Proxy Interception Mode.
Fixes an issue where the Zscaler CLI was incorrectly reporting an authentication status of AUTHENTICATION_REQUIRED instead of REGISTRATION_REQUIRED.
Fixes an issue where Zscaler Client Connector failed to clear all cached Kerberos tickets when the Force Kerberos Ticket Refresh after Private Access Reauthentication option is enabled in the app profile, prompting unexpected reauthentication.
Fixes an issue where Zscaler Client Connector did not retain user configuration changes after app restart.
Fixes an issue where Zscaler Client Connector ignored user-configured PAC URLs when attempting to override settings locally.
Fixes an issue where the Zscaler Client Connector returns false for all unsupported postures.
Fixes an issue where Zscaler Client Connector did not use the default browser when the app was installed with the externalRedirect installation parameter set to 1 and Authentication Browser Type under Platform Settings was set to Browser-Based Authentication with Default Browser enabled or to WebAuthn Popup Browser.
Fixes an issue where users were prompted to reauthenticate Private Access even though the Forwarding Profile Action for Private Access for the On-Trusted Network type was set to None.
Fixes an issue where users with Transparent Proxy-based Interception mode enabled could not access certain websites in Chromium-based browsers and via curl when the Custom IP-Based Application Bypass field configured in Zscaler Admin Console contained an empty string.
Fixes an issue where users could not load their captive portal due to Zscaler Client Connector failing to detect the portal.
Fixes an issue where Zscaler Client Connector reported an incorrect posture evaluation result for Jamf Trust and marked the device as noncompliant when the app's Apple App Store signing certificate has expired.
Fixes an issue where enrollment could fail with a Domain not Registered (3011) error when the Register device with ZPA IDP Username setting was enabled for customers who don't use Private Access.
Fixes an issue that resulted in FW/AV errors by adding the Process DNS Without Proxy Redirection option to change DNS processing logic. Zscaler recommends enabling this option when using Route-based Traffic Interception. To learn more, see Configuring Zscaler Client Connector App Profiles.

Zscaler Client Connector 4.10 Enhancements and Fixes

Tue, 18 Aug 2026 07:00:00 GMT

Enables automatic installation of the endpoint software used with Endpoint AI Security through Zscaler Client Connector. To learn more, contact your Zscaler Account team.

Zscaler Client Connector 4.5.2.355 Enhancements and Fixes

Wed, 12 Aug 2026 07:00:00 GMT

Supports using the ind.zscalertwo.net subcloud in the cloudName installation parameter for Zscaler Client Connector deployments in India.
Supports tunneling of ICMP requests to domain-name-based Private Access apps when using Transparent Proxy-based Interception.
Fixes an issue where Zscaler Client Connector failed to download the partner tenant policy when primary and partner tenants are hosted on different Zscaler clouds.
Fixes an issue where, in a no-default route environment, policy updates were sent directly instead of through the tunnel even though Tunnel Internal Client Connector Traffic was enabled.
Fixes an issue where users could not connect to Private Access apps due to DNS-related caching issues after waking up from sleep when using Transparent Proxy-based Interception.
Fixes an issue where a Zscaler Client Connector tunnel restarted if a network change occurred while the tunnel was stopped when using Transparent Proxy-based Interception.
Fixes an issue where Zscaler Client Connector crashed when users clicked Export Logs.

Zscaler Client Connector 4.7.0.351 Enhancements and Fixes

Wed, 12 Aug 2026 07:00:00 GMT

Supports using the ind.zscalertwo.net subcloud in the cloudName installation parameter for Zscaler Client Connector deployments in India.
Supports tunneling of ICMP requests to domain-name-based Private Access apps when using Transparent Proxy-based Interception.
Fixes an issue where Zscaler Client Connector failed to download the partner tenant policy when primary and partner tenants are hosted on different Zscaler clouds.
Fixes an issue where, if Fallback to gateway domain was selected, Zscaler Client Connector routed traffic to gateway.zscaler.net instead of the subcloud in the cached PAC file after the app restarted.
Fixes an issue where, in a no-default route environment, policy updates were sent directly instead of through the tunnel even though Tunnel Internal Client Connector Traffic was enabled.
Fixes an issue where users could not connect to Private Access apps due to DNS-related caching issues after waking up from sleep when using Transparent Proxy-based Interception.
Fixes an issue where a Zscaler Client Connector tunnel restarted if a network change occurred while the tunnel was stopped when using Transparent Proxy-based Interception.
Fixes an issue where Zscaler Client Connector crashed when users clicked Export Logs.
Fixes an issue where Zscaler Client Connector generated abnormally large Transparent Proxy-based Interception logs exceeding 100 MB, causing excessive disk usage.

Zscaler Client Connector 4.8.0.252 Enhancements and Fixes

Wed, 12 Aug 2026 07:00:00 GMT

Supports using the ind.zscalertwo.net subcloud in the cloudName installation parameter for Zscaler Client Connector deployments in India.
Supports tunneling of ICMP requests to domain-name-based Private Access apps when using Transparent Proxy-based Interception.
Fixes an issue where Zscaler Client Connector failed to download the partner tenant policy when primary and partner tenants are hosted on different Zscaler clouds.
Fixes an issue where, if Fallback to gateway domain was selected, Zscaler Client Connector routed traffic to gateway.zscaler.net instead of the subcloud in the cached PAC file after the app restarted.
Fixes an issue where, in a no-default route environment, policy updates were sent directly instead of through the tunnel even though Tunnel Internal Client Connector Traffic was enabled.
Fixes an issue where users could not connect to Private Access apps due to DNS-related caching issues after waking up from sleep when using Transparent Proxy-based Interception.
Fixes an issue where a Zscaler Client Connector tunnel restarted if a network change occurred while the tunnel was stopped when using Transparent Proxy-based Interception.
Fixes an issue where Zscaler Client Connector crashed when users clicked Export Logs.
Fixes an issue where Zscaler Client Connector generated abnormally large Transparent Proxy-based Interception logs exceeding 100 MB, causing excessive disk usage.

Zscaler Client Connector 4.5.2.341 Enhancements and Fixes

Mon, 27 Jul 2026 07:00:00 GMT

Fixes an issue where, after the device woke from sleep, Zscaler Client Connector couldn't immediately connect, which could cause traffic to temporarily be sent directly.
Fixes an issue where, if connected using a VPN, Zscaler Client Connector failed to activate Disaster Recovery for Internet & SaaS after updating the DNS TXT record value
Fixes an issue where, if Tunnel Internal Client Connector Traffic was enabled, Zscaler Client Connector didn't automatically log out after a device was force removed.
Fixes an issue where users received connection errors after a network change when Transparent Proxy-based Interception was enabled.

Zscaler Client Connector 4.7.0.330 Enhancements and Fixes

Mon, 27 Jul 2026 07:00:00 GMT

Fixes an issue where, after the device woke from sleep, Zscaler Client Connector couldn't immediately connect, which could cause traffic to temporarily be sent directly.
Fixes an issue where, if connected using a VPN, Zscaler Client Connector failed to activate Disaster Recovery for Internet & SaaS after updating the DNS TXT record value
Fixes an issue where, if Tunnel Internal Client Connector Traffic was enabled, Zscaler Client Connector didn't automatically log out after a device was force removed.
Fixes an issue where users received connection errors after a network change when Transparent Proxy-based Interception was enabled.

Zscaler Client Connector 4.8.0.230 Enhancements and Fixes

Mon, 27 Jul 2026 07:00:00 GMT

Fixes an issue where, after the device woke from sleep, Zscaler Client Connector couldn't immediately connect, which could cause traffic to temporarily be sent directly.
Fixes an issue where, if connected using a VPN, Zscaler Client Connector failed to activate Disaster Recovery for Internet & SaaS after updating the DNS TXT record value
Fixes an issue where, if Tunnel Internal Client Connector Traffic was enabled, Zscaler Client Connector didn't automatically log out after a device was force removed.
Fixes an issue where users received connection errors after a network change when Transparent Proxy-based Interception was enabled.

Zscaler Client Connector 4.5.2.334 Enhancements and Fixes

Wed, 15 Jul 2026 07:00:00 GMT

Updates the VPN Gateway Bypass to optionally not bypass subdomains for FQDNs. To learn more, see Bypassing FQDN Subdomains for VPN Gateway Bypass.
Fixes an issue where Run Zscaler Diagnostics on Zscaler Client Connector never completed or failed to start because the tool incorrectly detected another running instance and prompted for profile installation input during a UI-initiated run.
Fixes an issue where users lost internet connectivity because Internet & SaaS in Transparent Proxy-based Traffic Interception mode entered a tunnel restart rate-limited state and required a device restart to recover.
Fixes an issue where Zscaler Client Connector stopped consuming network changes after running for some time.
Fixes an issue where End User Notifications randomly stopped appearing for Data Loss Prevention (DLP) transactions until the Zscaler Client Connector service was restarted.
Fixes an issue where Zscaler Client Connector did not update Private Access with current posture results, causing access failures due to stale unverified posture status.
Fixes an issue where Internet & SaaS remained disabled despite valid entitlement and policy enforcement until Restart Service selected or Zscaler Client Connector was restarted.
Fixes an issue where overlapping Private Access auto-reauthentication flows caused SAML SP PKCE mismatches and displayed an Invalid Response Received error.
Fixes an issue where Zscaler Client Connector returned a bad request error during Private Access reauthentication for authentication service for end user migration pilot users.
Fixes an issue where Private Access reauthentication did not trigger for migrated users after session expiry, leaving access broken until Zscaler Client Connector was relaunched.
Fixes an issue where Zscaler Client Connector relied on an unreliable opendirectoryd lookup to detect Active Directory (AD) binding, which caused empty Private Access client-to-client FQDN registration data to be sent when the device was actually AD bound.
Fixes an issue where Private Access experienced connectivity failures after Zscaler Client Connector upgrades during device startup or resume from sleep, and provided the Mobile Device Management (MDM) flag disableFirewallHealthCheck to ignore the results of route-based tunnel echo health checks.
Fixes an issue where posture checks weren’t evaluated correctly for a partner if the domain of the partner tenant is on a different cloud than the main tenant.
Fixes an issue where dedicated IP forwarding traffic was not consistently captured by Internet & SaaS when users switched networks or toggled Wi-Fi, which caused applications to use a non-allowlisted source IP until Zscaler Client Connector was restarted.

Zscaler Client Connector 4.7.0.321 Enhancements and Fixes

Wed, 15 Jul 2026 07:00:00 GMT

Updates the VPN Gateway Bypass to optionally not bypass subdomains for FQDNs. To learn more, see Bypassing FQDN Subdomains for VPN Gateway Bypass.
Fixes an issue where Run Zscaler Diagnostics on Zscaler Client Connector never completed or failed to start because the tool incorrectly detected another running instance and prompted for profile installation input during a UI-initiated run.
Fixes an issue where users lost internet connectivity because Internet & SaaS in Transparent Proxy-based Traffic Interception mode entered a tunnel restart rate-limited state and required a device restart to recover.
Fixes an issue where Zscaler Client Connector stopped consuming network changes after running for some time.
Fixes an issue where End User Notifications randomly stopped appearing for Data Loss Prevention (DLP) transactions until the Zscaler Client Connector service was restarted.
Fixes an issue where Zscaler Client Connector did not update Private Access with current posture results, causing access failures due to stale unverified posture status.
Fixes an issue where Internet & SaaS remained disabled despite valid entitlement and policy enforcement until Restart Service selected or Zscaler Client Connector was restarted.
Fixes an issue where overlapping Private Access auto-reauthentication flows caused SAML SP PKCE mismatches and displayed an Invalid Response Received error.
Fixes an issue where Zscaler Client Connector returned a bad request error during Private Access reauthentication for authentication service for end user migration pilot users.
Fixes an issue where Private Access reauthentication did not trigger for migrated users after session expiry, leaving access broken until Zscaler Client Connector was relaunched.
Fixes an issue where Zscaler Client Connector relied on an unreliable opendirectoryd lookup to detect Active Directory (AD) binding, which caused empty Private Access client-to-client FQDN registration data to be sent when the device was actually AD bound.
Fixes an issue where Private Access experienced connectivity failures after Zscaler Client Connector upgrades during device startup or resume from sleep, and provided the Mobile Device Management (MDM) flag disableFirewallHealthCheck to ignore the results of route-based tunnel echo health checks.
Fixes an issue where posture checks weren’t evaluated correctly for a partner if the domain of the partner tenant is on a different cloud than the main tenant.
Fixes an issue where dedicated IP forwarding traffic was not consistently captured by Internet & SaaS when users switched networks or toggled Wi-Fi, which caused applications to use a non-allowlisted source IP until Zscaler Client Connector was restarted.

Zscaler Client Connector 4.8.0.221 Enhancements and Fixes

Wed, 15 Jul 2026 07:00:00 GMT

Updates the VPN Gateway Bypass to optionally not bypass subdomains for FQDNs. To learn more, see Bypassing FQDN Subdomains for VPN Gateway Bypass.
Fixes an issue where users lost internet connectivity because Internet & SaaS in Transparent Proxy-based Traffic Interception mode entered a tunnel restart rate-limited state and required a device restart to recover.
Fixes an issue where Zscaler Client Connector stopped consuming network changes after running for some time.
Fixes an issue where End User Notifications randomly stopped appearing for Data Loss Prevention (DLP) transactions until the Zscaler Client Connector service was restarted.
Fixes an issue where Zscaler Client Connector did not update Private Access with current posture results, causing access failures due to stale unverified posture status.
Fixes an issue where Internet & SaaS remained disabled despite valid entitlement and policy enforcement until Restart Service selected or Zscaler Client Connector was restarted.
Fixes an issue where overlapping Private Access auto-reauthentication flows caused SAML SP PKCE mismatches and displayed an Invalid Response Received error.
Fixes an issue where Zscaler Client Connector returned a bad request error during Private Access reauthentication for authentication service for end user migration pilot users.
Fixes an issue where Private Access reauthentication did not trigger for migrated users after session expiry, leaving access broken until Zscaler Client Connector was relaunched.
Fixes an issue where Zscaler Client Connector relied on an unreliable opendirectoryd lookup to detect Active Directory (AD) binding, which caused empty Private Access client-to-client FQDN registration data to be sent when the device was actually AD bound.
Fixes an issue where Private Access experienced connectivity failures after Zscaler Client Connector upgrades during device startup or resume from sleep, and provided the Mobile Device Management (MDM) flag disableFirewallHealthCheck to ignore the results of route-based tunnel echo health checks.
Fixes an issue where posture checks weren’t evaluated correctly for a partner if the domain of the partner tenant is on a different cloud than the main tenant.
Fixes an issue where dedicated IP forwarding traffic was not consistently captured by Internet & SaaS when users switched networks or toggled Wi-Fi, which caused applications to use a non-allowlisted source IP until Zscaler Client Connector was restarted.

Zscaler Client Connector 4.5.2.312 Enhancements and Fixes

Mon, 01 Jun 2026 07:00:00 GMT

Mitigates multiple remote code execution vulnerabilities. (CVE-2026-59568)
Fixes an authentication bypass issue for Zscaler Client Connector to Zscaler Client Connector Portal-only communications. (CVE-2026-59564)
Fixes multiple vulnerabilities that allowed for local privilege escalation. (CVE-2026-59567)
Fixes an issue where posture checks were failing for all postures due to a timeout of the Zero Trust Assessment (ZTA) Score posture.
Fixes an issue where users couldn’t access Zscaler Private Access (ZPA) client applications and encountered a no such host error with Transparent Proxy-based Traffic Interception.
Fixes an issue where all internet traffic was blocked by Zscaler Client Connector firewall with the enforceTrafficViaTunnel feature enabled and with Transparent Proxy-based Traffic Interception in use.
Fixes an issue which prevented Zscaler Tunnel (Z-Tunnel) from being established with Zscaler Client Connector in Strict Enforcement mode with Transparent Proxy-based Traffic Interception.
Fixes an issue where Zscaler Client Connector did not display an end user notification for ZPA reauthentication.
Fixes an issue where users did not receive end user notifications for inline Data Loss Prevention (DLP) events.

Zscaler Client Connector 4.7.0.292 Enhancements and Fixes

Mon, 01 Jun 2026 07:00:00 GMT

Mitigates multiple remote code execution vulnerabilities. (CVE-2026-59568)
Fixes an authentication bypass issue for Zscaler Client Connector to Zscaler Client Connector Portal-only communications. (CVE-2026-59564)
Fixes multiple vulnerabilities that allowed for local privilege escalation. (CVE-2026-59567)
Fixes an issue where posture checks were failing for all postures due to a timeout of the Zero Trust Assessment (ZTA) Score posture.
Fixes an issue where users couldn’t access Zscaler Private Access (ZPA) client applications and encountered a no such host error with Transparent Proxy-based Traffic Interception.
Fixes an issue where all internet traffic was blocked by Zscaler Client Connector firewall with the enforceTrafficViaTunnel feature enabled and with Transparent Proxy-based Traffic Interception in use.
Fixes an issue which prevented Zscaler Tunnel (Z-Tunnel) from being established with Zscaler Client Connector in Strict Enforcement mode with Transparent Proxy-based Traffic Interception.
Fixes an issue where Zscaler Client Connector did not display an end user notification for ZPA reauthentication.
Fixes an issue where users did not receive end user notifications for inline Data Loss Prevention (DLP) events.

Zscaler Client Connector 4.8.0.191 Enhancements and Fixes

Mon, 01 Jun 2026 07:00:00 GMT

Mitigates multiple remote code execution vulnerabilities. (CVE-2026-59568)
Fixes an authentication bypass issue for Zscaler Client Connector to Zscaler Client Connector Portal-only communications. (CVE-2026-59564)
Fixes multiple vulnerabilities that allowed for local privilege escalation. (CVE-2026-59567)
Fixes an issue where posture checks failed for all postures due to a timeout of the Zero Trust Assessment (ZTA) Score posture.
Fixes an issue where users couldn’t access Zscaler Private Access (ZPA) client applications and encountered a no such host error with Transparent Proxy-based Traffic Interception.
Fixes an issue where all internet traffic was blocked by Zscaler Client Connector firewall with the enforceTrafficViaTunnel feature enabled and with Transparent Proxy-based Traffic Interception in use.
Fixes an issue which prevented Zscaler Tunnel (Z-Tunnel) from being established with Zscaler Client Connector in Strict Enforcement mode with Transparent Proxy-based Traffic Interception.
Fixes an issue where Zscaler Client Connector did not display an end user notification for ZPA reauthentication.
Fixes an issue where users did not receive end user notifications for inline Data Loss Prevention (DLP) events.
Fixes an issue where end user notifications for inline DLP were not being displayed for Authentication Service (ZIdentity for Users) tenants.

Zscaler Client Connector 4.5.2.251 Enhancements and Fixes

Fri, 15 May 2026 07:00:00 GMT

Fixes an issue where the Zscaler Private Access (ZPA) partner tunnel failed to start after being stopped, or experiencing an unexpected termination.
Fixes an issue where the tunnel stopped forwarding traffic due to Transparent Proxy-based Traffic Interception being unloaded when connecting to Authentication Service for Users tenants.
Fixes an issue where Zscaler Client Connector intermittently disconnected from Zscaler Internet Access (ZIA) due to DHCP and DNS issues when connecting with Transparent Proxy-based Traffic Interception.
Fixes an issue which caused intermittent DNS resolution problems with an active Cisco AnyConnect VPN tunnel and with Zscaler Client Connector forwarding with Transparent Proxy-based Traffic Interception.
Fixes an issue where Zscaler Client Connector no longer tunnels traffic after switching from a Trusted to an Untrusted Network.
Fixes an issue where users lost network connectivity after Zscaler Client Connector received an updated App Profile policy, which switched traffic interception from route-based to Transparent Proxy-based Traffic Interception.

Zscaler Client Connector 4.7.0.233 Enhancements and Fixes

Fri, 15 May 2026 07:00:00 GMT

Fixes an issue where non-web traffic was bypassed while Transparent Proxy-based Traffic Interception was in use.
Fixes an issue where the Zscaler Private Access (ZPA) partner tunnel failed to start after being stopped, or experiencing an unexpected termination.
Fixes an issue where the tunnel stopped forwarding traffic due to Transparent Proxy-based Traffic Interception being unloaded when connecting to Authentication Service for Users tenants.
Fixes an issue where Zscaler Client Connector intermittently disconnected from Zscaler Internet Access (ZIA) due to DHCP and DNS issues when connecting with Transparent Proxy-based Traffic Interception.
Fixes an issue which caused intermittent DNS resolution problems with an active Cisco AnyConnect VPN tunnel and with Zscaler Client Connector forwarding with Transparent Proxy-based Traffic Interception.
Fixes an issue where Zscaler Client Connector no longer tunnels traffic after switching from a Trusted to an Untrusted Network.
Fixes an issue where users lost network connectivity after Zscaler Client Connector received an updated App Profile policy, which switched traffic interception from route-based to Transparent Proxy-based Traffic Interception.

Zscaler Client Connector 4.8.0.126 Enhancements and Fixes

Fri, 15 May 2026 07:00:00 GMT

Fixes an issue where non-web traffic was bypassed while Transparent Proxy-based Traffic Interception was in use.
Fixes an issue where the Zscaler Private Access (ZPA) partner tunnel failed to start after being stopped, or experiencing an unexpected termination.
Fixes an issue where the tunnel stopped forwarding traffic due to Transparent Proxy-based Traffic Interception being unloaded when connecting to Authentication Service for Users tenants.
Fixes an issue where Zscaler Client Connector intermittently disconnected from Zscaler Internet Access (ZIA) due to DHCP and DNS issues when connecting with Transparent Proxy-based Traffic Interception.
Fixes an issue which caused intermittent DNS resolution problems with an active Cisco AnyConnect VPN tunnel and with Zscaler Client Connector forwarding with Transparent Proxy-based Traffic Interception.
Fixes an issue where Zscaler Client Connector no longer tunnels traffic after switching from a Trusted to an Untrusted Network.
Fixes an issue where users lost network connectivity after Zscaler Client Connector received an updated App Profile policy, which switched traffic interception from route-based to Transparent Proxy-based Traffic Interception.

Zscaler Client Connector 4.5.2.221 Enhancements and Fixes

Fri, 01 May 2026 07:00:00 GMT

Fixes an issue where Google Chrome was able to access websites when Zscaler Tunnel (Z-Tunnel) was in a transient state with enforceTrafficVIaTunnel parameter enabled for Zscaler Client Connector firewall.
Fixes an issue where Zscaler Client Connector was prompting users with Zscaler Private Access (ZPA) disabled from the primary tenant to re-authenticate after every network change when accessing a Partner tenant.
Fixes an issue which caused Zscaler Client Connector to repeatedly prompt the user to re-authenticate with status of Registering device for Pilot users during Authentication Service for Users tenant migration.
Fixes an issue which caused DHCP requests to fail with Transparent Proxy-based Traffic Interception (TPTI).
Fixes an issue where routes were being incorrectly added by Zscaler Client Connector when forwarding in Tunnel with Local Proxy mode.
Fixes an issue where the Forwarding Profile PAC was being set incorrectly on devices using non-default listener ports when forwarding in Tunnel with Local Proxy or Enforce Proxy mode.
Fixes an issue which caused non-web traffic connections to close prematurely when forwarding in Z-Tunnel 2.0 mode with TPTI.
Fixes an issue where the Z-Tunnel process crashed with an EXC_BAD_ACCESS error when forwarding in TPTI mode.
Fixes an issue where the Zscaler speedtest diagnostic failed to launch Diagnostics in the More window when TPTI is in use.

Zscaler Client Connector 4.7.0.207 Enhancements and Fixes

Fri, 01 May 2026 07:00:00 GMT

Fixes an issue where Google Chrome was able to access websites when Zscaler Tunnel (Z-Tunnel) was in a transient state with enforceTrafficVIaTunnel parameter enabled for Zscaler Client Connector firewall.
Fixes an issue where Zscaler Client Connector was prompting users with Zscaler Private Access (ZPA) disabled from the primary tenant to re-authenticate after every network change when accessing a Partner tenant.
Fixes an issue which caused Zscaler Client Connector to repeatedly prompt the user to re-authenticate with status of Registering device for Pilot users during Authentication Service for Users tenant migration.
Fixes an issue which caused DHCP requests to fail with Transparent Proxy-based Traffic Interception (TPTI).
Fixes an issue where routes were being incorrectly added by Zscaler Client Connector when forwarding in Tunnel with Local Proxy mode.
Fixes an issue where the Forwarding Profile PAC was being set incorrectly on devices using non-default listener ports when forwarding in Tunnel with Local Proxy or Enforce Proxy mode.
Fixes an issue which caused non-web traffic connections to close prematurely when forwarding in Z-Tunnel 2.0 mode with TPTI.
Fixes an issue where the Z-Tunnel process crashed with an EXC_BAD_ACCESS error when forwarding in TPTI mode.
Fixes an issue where the Zscaler speedtest diagnostic failed to launch Diagnostics in the More window when TPTI is in use.

Zscaler Client Connector 4.8.0.104 Enhancements and Fixes

Fri, 01 May 2026 07:00:00 GMT

Fixes an issue where Google Chrome was able to access websites when Zscaler Tunnel (Z-Tunnel) was in a transient state with enforceTrafficVIaTunnel parameter enabled for Zscaler Client Connector firewall.
Fixes an issue where Zscaler Client Connector was prompting users with Zscaler Private Access (ZPA) disabled from the primary tenant to re-authenticate after every network change when accessing a Partner tenant.
Fixes an issue which caused Zscaler Client Connector to repeatedly prompt the user to re-authenticate with status of Registering device for Pilot users during Authentication Service for Users tenant migration.
Fixes an issue which caused DHCP requests to fail with Transparent Proxy-based Traffic Interception (TPTI).
Fixes an issue where routes were being incorrectly added by Zscaler Client Connector when forwarding in Tunnel with Local Proxy mode.
Fixes an issue where the Forwarding Profile PAC was being set incorrectly on devices using non-default listener ports when forwarding in Tunnel with Local Proxy or Enforce Proxy mode.
Fixes an issue which caused non-web traffic connections to close prematurely when forwarding in Z-Tunnel 2.0 mode with TPTI.
Fixes an issue where traffic interception failed due to Transparent Proxy-based Traffic process crash.
Fixes an issue where the Z-Tunnel process crashed with an EXC_BAD_ACCESS error when forwarding in TPTI mode.
Fixes an issue where the Zscaler speedtest diagnostic failed to launch Diagnostics in the More window when TPTI is in use.

Zscaler Client Connector 4.5.2.201 Enhancements and Fixes

Fri, 03 Apr 2026 07:00:00 GMT

Fixes an issue where the Zscaler speedtest diagnostic failed to launch the More Diagnostics window when Transparent Proxy-based Traffic Interception (TPTI) is in use.
Fixes an issue where posture evaluation for ZPA machine tunnels caused an error after user login.
Fixes an issue where DNS over HTTPS traffic was blocked to local LAN DNS server when TPTI is in use.
Fixes an issue where Zscaler Client Connector did not return NXDomain in order to block iCloud Private Relay with TPTI.
Fixes an issue where the menu bar icon of Zscaler Client Connector incorrectly displayed a red notification when Zscaler Internet Access (ZIA) and ZPA services were operational.
Fixes an issue where DNS queries were tunneled incorrectly when a third-party VPN client was active in split VPN mode when TPTI is in use by disabling DNS search ordering.
Fixes an issue where ZPA displayed an SMZPA_CCC_ZMTP_ACS_INT_ERR error for ZPA inspected traffic when TPTI is in use.
Fixes an issue where the internet became inaccessible when ZIA is disabled when TPTI is in use.
Fixes an issue where Zscaler Client Connector incorrectly handled an exception caused by an invalid pointer, resulting in an unexpected tunnel failure with TPTI in use.
Fixes an issue where there was high CPU consumption when Zscaler Client Connector was setting up ZPA search domains on the system when TPTI is in use.
Fixes an issue where the TPTI tunnel faces a failure and is disconnected when all other services show as functional.
Fixes an issue where Zscaler Client Connector ignored configured certificate templates when performing posture checks, resulting in the posture check passing even with mismatched templates.
Fixes an issue where the Trusted Network Criteria incorrectly judges a trusted network as a non-trusted network, causing Zscaler Client Connector to keep ZPA active even when running on a trusted network.

Zscaler Client Connector 4.7.0.187 Enhancements and Fixes

Fri, 03 Apr 2026 07:00:00 GMT

Fixes an issue where the Zscaler speedtest diagnostic failed to launch the More Diagnostics window when Transparent Proxy-based Traffic Interception (TPTI) is in use.
Fixes an issue where Zscaler Private Access (ZPA) ReAuth Notification with Advanced Notification sent reauthenticate notices at incorrect times, blocking access to applications and forcing reauthentication before the SAML was set to expire.
Fixes an issue where posture evaluation for ZPA machine tunnels caused an error after user login.
Fixes an issue where DNS over HTTPS traffic was blocked to local LAN DNS server when TPTI is in use.
Fixes an issue where Zscaler Client Connector did not return NXDomain in order to block iCloud Private Relay with TPTI.
Fixes an issue where the menu bar icon of Zscaler Client Connector incorrectly displayed a red notification when Zscaler Internet Access (ZIA) and ZPA services were operational.
Fixes an issue where DNS queries were tunneled incorrectly when a third-party VPN client was active in split VPN mode when TPTI is in use by disabling DNS search ordering.
Fixes an issue where ZPA displayed an SMZPA_CCC_ZMTP_ACS_INT_ERR error for ZPA inspected traffic when TPTI is in use.
Fixes an issue where the internet became inaccessible when ZIA is disabled when TPTI is in use.
Fixes an issue where Zscaler Client Connector incorrectly handled an exception caused by an invalid pointer, resulting in an unexpected tunnel failure with TPTI in use.
Fixes an issue where there was high CPU consumption when Zscaler Client Connector was setting up ZPA search domains on the system when TPTI is in use.
Fixes an issue where the TPTI tunnel faces a failure and is disconnected when all other services show as functional.
Fixes an issue where Zscaler Client Connector ignored configured certificate templates when performing posture checks, resulting in the posture check passing even with mismatched templates.
Fixes an issue where the Trusted Network Criteria incorrectly judges a trusted network as a non-trusted network, causing Zscaler Client Connector to keep ZPA active even when running on a trusted network.

Zscaler Client Connector 4.8.0.83 Enhancements and Fixes

Fri, 03 Apr 2026 07:00:00 GMT

Fixes an issue where the Zscaler speedtest diagnostic failed to launch the More Diagnostics window when Transparent Proxy-based Traffic Interception (TPTI) is in use.
Fixes an issue where Zscaler Private Access (ZPA) ReAuth Notification with Advanced Notification sent reauthenticate notices at incorrect times, blocking access to applications and forcing reauthentication before the SAML was set to expire.
Fixes an issue where posture evaluation for ZPA machine tunnels caused an error after user login.
Fixes an issue where DNS over HTTPS traffic was blocked to local LAN DNS server when TPTI is in use.
Fixes an issue where Zscaler Client Connector prematurely switched to the secondary ZPA Public Service Edge for customers using Dynamic ZPA Service Edge Assignment.
Fixes an issue where the Private Access and Internet Security windows of the app flickered between On and Off states while reauthenticating ZPA when using TPTI.
Fixes an issue where users received a Failed to Start Diagnostics error after clicking Run Zscaler Diagnostics on the More window of the app.
Fixes an issue where Zscaler Client Connector did not return NXDomain in order to block iCloud Private Relay with TPTI.
Fixes an issue where the menu bar icon of Zscaler Client Connector incorrectly displayed a red notification when Zscaler Internet Access (ZIA) and ZPA services were operational.
Fixes an issue where DNS queries were tunneled incorrectly when a third-party VPN client was active in split VPN mode when TPTI is in use by disabling DNS search ordering.
Fixes an issue where ZPA displayed an SMZPA_CCC_ZMTP_ACS_INT_ERR error for ZPA inspected traffic when TPTI is in use.
Fixes an issue where the internet became inaccessible when ZIA is disabled when TPTI is in use.
Fixes an issue where Zscaler Client Connector incorrectly handled an exception caused by an invalid pointer, resulting in an unexpected tunnel failure with TPTI in use.
Fixes an issue where there was high CPU consumption when Zscaler Client Connector was setting up ZPA search domains on the system when TPTI is in use.
Fixes an issue where the TPTI tunnel faces a failure and is disconnected when all other services show as functional.
Fixes an issue where Zscaler Client Connector ignored configured certificate templates when performing posture checks, resulting in the posture check passing even with mismatched templates.
Fixes an issue where the Trusted Network Criteria incorrectly judges a trusted network as a non-trusted network, causing Zscaler Client Connector to keep ZPA active even when running on a trusted network.

Zscaler Client Connector 4.5.2.175 Enhancements and Fixes

Fri, 06 Mar 2026 08:00:00 GMT

Fixes an issue where, if the Redirect Web Traffic to Zscaler Client Connector Listening Proxy and Transparent Proxy-based Interception options were enabled, Digital Experience (ZDX) Web probe requests were sent to Zscaler Internet Access (ZIA) even though the app profile PAC file was set to bypass the traffic.
Fixes an issue where users received a Failed to Start Diagnostics error after clicking Run Zscaler Diagnostics on the More window of the app.
Fixes an issue where, after detecting a captive portal and disabling services temporarily, Zscaler Client Connector sent traffic directly instead of based on the app failover settings.
Fixes an issue that caused the OS Version device posture check to fail after upgrading to macOS 26.2.
Fixes an issue where Zscaler Client Connector consumed high CPU resources when connected to Zscaler Private Access (ZPA) while using Transparent Proxy-based Traffic Interception.
Fixes an issue where the Private Access and Internet Security windows of the app flickered between On and Off states while reauthenticating ZPA when using Transparent Proxy-based Traffic Interception.
Removed the trailing whitespace used by Zscaler Client Connector in the user-agent string.
Fixes a memory consumption issue that resulted in Zscaler Client Connector not connecting after the device woke from sleep when using Transparent Proxy-based Traffic Interception.
Fixes an issue that resulted in a tunnel crash when using Transparent Proxy-based Traffic Interception.
Fixes an issue which caused Kerberos SSO to fail when using Transparent Proxy-based Traffic Interception.
Fixes an issue where Zscaler Client Connector prematurely switched to the secondary ZPA Public Service Edge for customers using Dynamic ZPA Service Edge Assignment.

Zscaler Client Connector 4.7.0.155 Enhancements and Fixes

Fri, 06 Mar 2026 08:00:00 GMT

Fixes an issue where, if the Redirect Web Traffic to Zscaler Client Connector Listening Proxy and Transparent Proxy-based Interception options were enabled, Digital Experience (ZDX) Web probe requests were sent to Zscaler Internet Access (ZIA) even though the app profile PAC file was set to bypass the traffic.
Fixes a memory consumption issue that resulted in Zscaler Client Connector not connecting after the device woke from sleep when using Transparent Proxy-based Traffic Interception.
Fixes an issue where users received a Failed to Start Diagnostics error after clicking Run Zscaler Diagnostics on the More window of the app.
Fixes an issue where, after detecting a captive portal and disabling services temporarily, Zscaler Client Connector sent traffic directly instead of based on the app failover settings.
Fixes an issue that caused the OS Version device posture check to fail after upgrading to macOS 26.2.
Fixes an issue where Zscaler Client Connector consumed high CPU resources when connected to Zscaler Private Access (ZPA) while using Transparent Proxy-based Traffic Interception.
Fixes an issue where some domains (e.g., google.com) were inaccessible after turning off ZIA.
Fixes an issue where the Private Access and Internet Security windows of the app flickered between On and Off states while reauthenticating ZPA when using Transparent Proxy-based Traffic Interception.
Removed the trailing whitespace used by Zscaler Client Connector in the user-agent string.
Fixes an issue which caused Kerberos SSO to fail when using Transparent Proxy-based Traffic Interception.
Fixes an issue where Zscaler Client Connector prematurely switched to the secondary ZPA Public Service Edge for customers using Dynamic ZPA Service Edge Assignment.

Zscaler Client Connector 4.8 Enhancements and Fixes

Mon, 02 Mar 2026 08:00:00 GMT

This version of Zscaler Client Connector has a known issue where Zscaler Client Connector prematurely switched to the secondary ZPA Public Service Edge for customers using Dynamic ZPA Service Edge Assignment. This issue has been corrected on Zscaler Client Connector version 4.8.0.83.

Supports Authentication Service integration for the following features: using Digital Experience (ZDX) without Zscaler Internet Access (ZIA) or Zscaler Private Access (ZPA), reverting to earlier versions, using device groups, machine tunnel authentication, using one-time passwords (OTPs), quarantining devices, and displaying the service disable reason. To learn more, see What is Authentication Service.
Enhances the CrowdStrike ZTA posture by introducing two new device posture checks: CrowdStrike ZTA Device OS Score and CrowdStrike ZTA Sensor Setting Score.
Supports forcing a Kerberos ticket refresh after ZPA reauthentication. To learn more, see Configuring Zscaler Client Connector App Profiles.
Adds failover settings to the app profile that can override the global fail over settings. To learn more, see Configuring Zscaler Client Connector App Profiles.
Supports a device posture check for specific Zscaler Client Connector versions. To learn more, see Configuring Device Posture Profiles.
Supports process-based application bypass using custom application bypasses defined in the Zscaler Client Connector Portal when you use Transparent Proxy-based Traffic Interception. To learn more, see Adding Process-Based Applications to Bypass Traffic.
Supports a new traffic forwarding action for ZIA Disaster Recovery so you can forward traffic using Zscaler Tunnel (Z-Tunnel) 2.0. To learn more, see Configuring Zscaler Client Connector App Profiles.
Fixes an issue where a Authentication Service user could not log in to Zscaler Client Connector if their login name included a special character (e.g., # or @).
Fixes an issue where Zscaler Client Connector caused excessive battery usage with ZDX when using ZDX Module version 4.5 and earlier.
Fixes an issue where Zscaler Client Connector failed to re-enroll after the ZPA certificate expired with Authentication Service.
Fixes an issue where the Zscaler would like to use your current location pop-up message displayed when it should not have because the Collect Location Info for ZDX option was disabled.
Fixes delays with single sign-on using browser-based authentication for devices with Auto Proxy Discovery enabled and using Transparent Proxy-based Traffic Interception.
Fixes a case sensitivity issue that caused a Domain Joined device posture check to fail, even though the domain matched.
Fixes an issue that caused the OS Version device posture check to fail for a machine tunnel even though the device used the correct OS version.
Fixes an issue where, after disabling ZIA, an old PAC file was restored instead of the one applied by the Jamf Pro deployment when users had Transparent Proxy-based Traffic Interception enabled with the Cache System Proxy option enabled.
Fixes a connection delay to ZPA that occurred when, after disabling ZPA, a user clicked Turn On if the user had a custom profile for VPN (for Legacy Apps) enabled.
Fixes a connection delay to Zscaler Client Connector that occurred after a device woke up from being idle for a long time or after a restart.
Fixes an issue where, after users clicked Run Zscaler Diagnostics on the More window in the app, the process took a long time to run or became stuck.
Fixes an issue where the Policy Name on the Device Management page was not updated correctly for Authentication Service users with an app profile applied by device group.
Fixes an issue where, if Device Groups are used for ZPA service entitlement, ZPA wasn't enabled for a user who logged in to the macOS device after another user logged out.
Fixes an issue where, if the Redirect Web Traffic to Zscaler Client Connector Listening Proxy and Transparent Proxy-based Traffic Interception options were enabled, ZDX Web probe requests were sent to ZIA even though the app profile PAC file was set to bypass the traffic.
Fixes an issue that caused the OS Version device posture check to fail after upgrading Zscaler Client Connector until the next successful policy update.
Fixes an issue where, after detecting a captive portal and disabling services temporarily, Zscaler Client Connector sent traffic directly instead of based on the app failover settings.
Fixes an issue that caused the OS Version device posture check to fail after upgrading to macOS 26.2.
Fixes an issue where some domains (e.g., google.com) were inaccessible after turning off ZIA.
Removed the trailing whitespace used by Zscaler Client Connector in the user-agent string.
Fixes an issue which caused Kerberos SSO to fail when using Transparent Proxy-based Traffic Interception.

Zscaler Client Connector 4.5.2.158 Enhancements and Fixes

Thu, 12 Feb 2026 08:00:00 GMT

Fixes an issue that caused the OS Version device posture check to fail after upgrading Zscaler Client Connector until the next successful policy update.

Zscaler Client Connector 4.7.0.134 Enhancements and Fixes

Thu, 12 Feb 2026 08:00:00 GMT

Fixes an issue that caused the OS Version device posture check to fail after upgrading Zscaler Client Connector until the next successful policy update.

Zscaler Client Connector 4.5.2.153 Enhancements and Fixes

Mon, 09 Feb 2026 08:00:00 GMT

This version of Zscaler Client Connector has a known issue that causes the OS Version device posture check to fail after upgrading Zscaler Client Connector until the next successful policy update. The issue has been corrected on Zscaler Client Connector version 4.5.2.158.

Fixes an issue where Zscaler Client Connector caused excessive battery usage with Digital Experience (ZDX) when using ZDX Module version 4.5 and earlier.
Fixes an issue where Xcode to iOS device communication was blocked when users had Transparent Proxy-based Interception enabled.
Fixes an issue where users were unexpectedly logged out of Zscaler Client Connector after a period of inactivity, requiring them to log in again upon returning.
Fixes a case sensitivity issue that caused a Domain Joined device posture check to fail, even though the domain matched.
Fixes an issue that prevented logging in to Zscaler Client Connector due to a DNS error caused by incorrect keychain data after upgrading to macOS Tahoe in Strict Enforcement mode.
Fixes an issue that caused the OS Version device posture check to fail for a machine tunnel even though the device was the correct OS version.
Fixes an issue where, after disabling Zscaler Internet Access (ZIA), an old PAC file was restored instead of the one applied by the Jamf Pro deployment when users had Transparent Proxy-based Interception enabled with the Cache System Proxy option enabled.
Fixes a connection delay to Zscaler Private Access (ZPA) that occurred when, after disabling ZPA, a user clicked Turn On if the user had a custom profile for VPN (for Legacy Apps) enabled.
Fixes a connection delay to Zscaler Client Connector that occurred after a device woke up from being idle for a long time or after a restart.
Fixes an issue where, after users clicked Run Zscaler Diagnostics on the More window in the app, the process took a long time to run or became stuck.
Fixes an issue where Zscaler Client Connector in Transparent Proxy-based Interception (TRP) mode added routes incorrectly resulting in connection errors to applications bypassed using IP-based Application Bypass.
Fixes an issue where, if Device Groups are used for ZPA service entitlement, ZPA wasn't enabled for a user who logged in to the macOS device after another user logged out.
Fixes an issue where Zscaler Client Connector didn’t accept some DNS query record types (e.g., CNAME), resulting in some domains not being tunneled.

Zscaler Client Connector 4.7.0.126 Enhancements and Fixes

Mon, 09 Feb 2026 08:00:00 GMT

Fixes an issue where Zscaler Client Connector caused excessive battery usage with Digital Experience (ZDX) when using ZDX Module version 4.5 and earlier.
Fixes an issue where Xcode to iOS device communication was blocked when users had Transparent Proxy-based Interception enabled.
Fixes a case sensitivity issue that caused a Domain Joined device posture check to fail, even though the domain matched.
Fixes an issue that prevented logging in to Zscaler Client Connector due to a DNS error caused by incorrect keychain data after upgrading to macOS Tahoe in Strict Enforcement mode.
Fixes an issue that caused the OS Version device posture check to fail for a machine tunnel even though the device was the correct OS version.
Fixes an issue where, after disabling Zscaler Internet Access (ZIA), an old PAC file was restored instead of the one applied by the Jamf Pro deployment when users had Transparent Proxy-based Interception enabled with the Cache System Proxy option enabled.
Fixes a connection delay to Zscaler Private Access (ZPA) that occurred when, after disabling ZPA, a user clicked Turn On if the user had a custom profile for VPN (for Legacy Apps) enabled.
Fixes a connection delay to Zscaler Client Connector that occurred after a device woke up from being idle for a long time or after a restart.
Fixes an issue where, after users clicked Run Zscaler Diagnostics on the More window in the app, the process took a long time to run or became stuck.
Fixes an issue where, if Device Groups are used for ZPA service entitlement, ZPA wasn't enabled for a user who logged in to the macOS device after another user logged out.
Fixes an issue where Zscaler Client Connector didn’t accept some DNS query record types (e.g., CNAME), resulting in some domains not being tunneled.

Zscaler Client Connector 4.5.0.343 Enhancements and Fixes

Wed, 28 Jan 2026 08:00:00 GMT

Fixes a connection delay to Zscaler Private Access (ZPA) that occurred when, after disabling ZPA, a user clicked Turn On if the user had a custom profile for VPN (for Legacy Apps) enabled.
Fixes an issue where, if Device Groups are used for ZPA service entitlement, ZPA wasn't enabled for a user who logged in to the macOS device after another user logged out.