Trust

Zscaler Update on eMudhra Intermediate Certificate Exposure - zscaler.net, zscalerone.net, zscalertwo.net, zscloud.net, zscalerthree.net, private.zscaler.com, zdxcloud.net, zpatwo.net, app.zsdpc.net, app.eu.zsdpc.net, zpabeta.net, zsdkone.net, zscalerrisk.net, admin.zscaleranalytics.net, zslogin.net, app.avalor.io, app.eu.avalor.io, app.aps.avalor.io, ztb-us-m2, ztb-us-m3 (beta), ztb-us-m4, ztb-us-m7, ztb-euc-m1, ztb-in-m1, pulsar, quasar, prod3, prod4, prod5, prod6, zseclipse.net, zsaiguard.net, app.in.zsdpc.net

Thu, 22 Oct 2026 00:00:00 GMT

Zscaler is aware of reports of compromised TLS intermediate certificates associated with digital certificate provider eMudhra.

Zscaler found no evidence of compromise within the Zscaler environment. The Zscaler Engineering and Security teams conducted an exhaustive investigation to identify and remove all relevant certificates from our products’ root certificate bundles. Zscaler does not rely internally on eMudhra certificates or services but has taken the following actions and provides the following recommended guidance for customers.

Internet & SaaS (ZIA) Cloud Platform

The Internet & SaaS cloud platform has been updated to remove impacted intermediate certificates from the root certificate bundle associated with eMudhra.

Private Access (ZPA) Cloud Platform

Zscaler has identified no impact to the Private Access cloud platform at this time. Out of an abundance of caution, Zscaler removed the impacted intermediate certificates from the root certificate bundle associated with eMudhra.

Root certificate bundle updates will be applied to Private Access cloud platforms during each region’s scheduled maintenance window in accordance with our standard change-management procedures. No service disruption is anticipated as a result of this activity.

Private Access-Distributed Software Products

Zscaler has released a software update (version number 26.58.5) to remove impacted intermediate certificates from the root certificate bundle associated with eMudhra in the following customer-deployed products:

App Connectors
Private Service Edges
Private Cloud Controllers
Network Connectors

Zscaler recommends updating these components at the earliest opportunity to protect against Man-in-the-Middle attacks leveraging the compromised intermediate certificates.

Zscaler automatically deploys the updates during your regularly scheduled upgrade windows as outlined in Scheduling Periodic Software Updates in Private Access.

If you are concerned and would like to manually update Private Access components immediately, follow the steps in Configuring a Version Profile with the New Release 26.58.5, and schedule the update.

Additionally, if your organization has TLS certificates issued by eMudhra intermediate CAs, those certificates will no longer be trusted by Private Access after this update. Contact your certificate provider or Zscaler Support if you believe this applies to you.

Zscaler recommends that customers upgrade any customer maintained operating systems according to vendor recommendations for the most secure environment.

Zero Trust Browser

The Zero Trust Browser platform has been updated to address exposure associated with the compromised intermediate certificates.

Additional Security Guidance

Customers are advised to apply all relevant vendor, operating system, and platform certificate updates promptly, especially in environments that use independently managed trust stores or custom certificate bundles.

Zscaler will continue to monitor the situation closely and provide necessary updates.

Zscaler Update on PHP CVEs (CVE-2026-109618, CVE-2026-109619) - zscaler.net, zscalerone.net, zscalertwo.net, zscloud.net, zscalerthree.net, private.zscaler.com, zdxcloud.net, zpatwo.net, app.zsdpc.net, app.eu.zsdpc.net, zpabeta.net, zsdkone.net, zscalerrisk.net, admin.zscaleranalytics.net, zslogin.net, app.avalor.io, app.eu.avalor.io, app.aps.avalor.io, ztb-us-m2, ztb-us-m3 (beta), ztb-us-m4, ztb-us-m7, ztb-euc-m1, ztb-in-m1, pulsar, quasar, prod3, prod4, prod5, prod6, zseclipse.net, zsaiguard.net, app.in.zsdpc.net

Wed, 21 Oct 2026 00:00:00 GMT

Zscaler is aware of the recently disclosed PHP CVEs. Our Security and Engineering teams are assessing potential impact and will update this post as the new information emerges.

Update Wed, 21 Oct 2026 23:00:31 UTC

After thorough assessment by our Security and Engineering teams, there is no impact to Zscaler Cloud Platforms. We will update this post as the new information emerges.

Update Thu, 22 Oct 2026 18:30:00 UTC

After thorough assessment by our Security and Engineering teams, there is no impact to Zscaler Cloud Platforms, products, distributed components, services, and our enterprise environment. This advisory is now closed.

Cloud Connector Certificate Expiration - zscaler.net, zscalertwo.net, zscloud.net, zscalerthree.net

Sat, 10 Oct 2026 00:00:00 GMT

The TLS certificate for the Zscaler Cloud Connector software update repository will expire on March 18, 2027. To preserve software update functionality and avoid deployment failures, customers must update their virtual machines or use the latest Marketplace images. Zscaler recommends that all customers complete these updates by December 31, 2026.

Action Required

Please follow the guidance below based on your deployment type:

Deployment Type	Action Required	Details
Existing Running Cloud Connectors	No action required	Zscaler is deploying an automatic update to patch the CA trust bundle. No restart is needed
New Cloud Connector Deployments	Use updated Marketplace image	Must use the updated image when deploying new Cloud Connectors after March 18, 2027

Who is affected and why

Cloud Connector and Branch Connector virtual machines running versions lower than 1.146 are impacted. These versions lack the DigiCert G2 certificate chain required to validate the newly updated software packages published to package repo after March 18, 2027.

Zscaler published an automatic software patch in March 2026 that recognizes the new DigiCert G2 certificate chain. It’s included in the software version numbers:

Cloud Connector - version 1.146.5 or higher
Branch Connector - version 1.146.0 or higher

How to determine if you are affected

Check your Cloud Connector software version: In the Zscaler portal
- Navigate to the “Cloud Connector Groups” page
- Expand the group, edit an individual cloud connector
- Click on “Upgrade Status”
- Cloud Connectors running version 1.146 or higher have already received the software patch and are not affected.
Check your Branch Connector software version: In the Zscaler portal
- Navigate to the “Branch Devices” page
- Expand the group, edit an individual branch connector
- Branch Connectors running version 1.146 or higher have already received the software patch and are not affected.
Check your deployment image version: If you are deploying new Cloud Connectors or using ASGs, verify your launch configuration.

See: Identifying Cloud Connector Versions

AWS: Check the AMI ID in your Launch Templates or IaC Templates
- Minimum Image Version: ZS42.1.0 (Deployed AMI Name: starts with zs-cc-ga-03092026)
Azure: Check the image version in your VM Scale Set or deployment template
- Minimum Image Version: 42.1.0 (Latest)
GCP: Check the image in your Instance Template
- Minimum Image Name: zs-cc-ga-03092026
If your image version is older than any minimum version referenced, you are using an affected image and must update your templates.

Additional Information and FAQs

What is expiring?
- The TLS server certificate for Zscaler's Cloud Connector software update repository (`pkg-repo.zscaler.com`) expires on March 18, 2027. When this certificate is renewed, the repository will begin using a new DigiCert G2 certificate chain. Currently deployed Cloud Connectors contain a CA trust bundle that only recognizes the older G1 certificate chain and cannot validate the new G2 chain.
When does it expire?
- March 18, 2027. After this date, the software update repository will serve a new certificate that existing Cloud Connector images cannot validate.

For details, upgrade guidance, and frequently asked questions, refer to:

What if i have more questions:

If you have additional questions, contact Zscaler Support.

ZPA Browser Application returning error 403 - private.zscaler.com, zpatwo.net, zpabeta.net

Mon, 05 Oct 2026 00:00:00 GMT

Symptoms: ZPA Users attempting to access Browser Access or User Portal applications may intermittently receive a 403 Forbidden error, preventing them from accessing application.

Condition: This occurs when a browser session cookie from a previous authentication becomes stale, typically recurring every 7 days aligned with the session lifetime. If users continue to use the same session beyond 7 days to the application they may observe this error on the browser.

Workaround: Clearing browser cookies and cache, or using a private/incognito browser window, will restore access to the application.

Fix: Zscaler is working on a permanent fix, which is expected to be rolled out across the clouds by end of next week.

Network Degradation – Philippines to Singapore Data Centers (SIN4 & SIN5) - zscaler.net, zscalerone.net, zscalertwo.net, zscloud.net, zscalerthree.net

Fri, 02 Oct 2026 00:00:00 GMT

Zscaler is aware of a network issue affecting customers in the Philippines who are forwarding traffic to the Singapore data centers SIN4 and SIN5. Affected customers may experience degraded connectivity, increased latency, or packet loss when routing through these data centers. Our investigation confirms that Zscaler infrastructure is stable and operating normally — the issue has been identified as occurring within the Philippines network, specific to certain ISPs in the region.

If you’re currently experiencing any traffic impacting issues please failover to any other alternate DC outside Singapore. For more information, please refer to the following support article.

Update - Tue, 06 Oct 2026 04:58:08 UTC

The network issue affecting customers in the Philippines routing traffic through SIN4 and SIN5 appears to have subsided. Zscaler is no longer receiving reports of impact, and this issue is now marked as resolved.

Announcing ZCC Long Term Support (LTS) versions for 2027 - zscaler.net, zscalerone.net, zscalertwo.net, zscloud.net, zscalerthree.net, private.zscaler.com, zdxcloud.net, zpatwo.net, zscalerrisk.net, zslogin.net

Thu, 01 Oct 2026 00:00:00 GMT

Zscaler Client Connector Long-Term Support (LTS) is intended for organizations that need longer change windows and prefer a more stable release cycle. An LTS version receives critical bug fixes and security updates for up to 12 months, without introducing new features or feature-related changes.You can read more about this program here.

While Zscaler generally recommends adopting the latest General Availability (GA) version, customers with stricter change management requirements may prefer the LTS version.

What is changing?
Previously, LTS versions transitioned in January each year. Based on feedback, we are moving the transition to April to provide a smoother upgrade experience. Effective April 30, 2027, the new LTS major versions will be as follows: :

Windows: Zscaler Client Connector 4.9
macOS: Zscaler Client Connector 4.8
Linux: Zscaler Client Connector 4.2.2

Who is impacted?
Customers running the current (2026) LTS versions, or non supported versions should plan to upgrade to at least the 2027 LTS versions.

What are my next steps?
If you are currently running the 2026 LTS version or an earlier unsupported version, plan to upgrade to the 2027 LTS major version or other currently supported version. Zscaler recommends leveraging the built in group based app upgrades, or your client management/MDM tool to validate the new versions in your environment before upgrading your broader groups of devices.

What if I have more questions?
If you have additional questions, contact Zscaler Support via the Support link in the ZIA Admin Portal or call us at +1 (844) 971-0010.

Required Action: Redeploy Virtual Connectors to ZscalerOS 42 (ZSOS42) and Upgrade Physical Appliances to ZscalerOS 42 (ZSOS42) - zscaler.net, zscalertwo.net, zscloud.net, zscalerthree.net

Thu, 01 Oct 2026 00:00:00 GMT

Zscaler is announcing the official End-of-Life (EOL) and End-of-Support for ZscalerOS 24 (ZSOS24), effective December 31, 2026. To maintain continuous secure connectivity and ensure uninterrupted technical support, all organizations operating Cloud Connector (CC) and Branch Connector (BC) infrastructure on ZSOS24 must execute their respective transition paths prior to the EOL date.

The migration pathways are determined by appliance form factor:

Virtual Connectors (Cloud Connector & Virtual Branch Connector):

Mandatory Redeployment to ZSOS42: Due to major architectural enhancements, new kernel baselines, and modified disk partitioning structures, in-place automated OS upgrades are not supported. All virtual instances in AWS, Azure, GCP, VMware ESXi, Linux KVM, and Microsoft Hyper-V must be redeployed using official ZscalerOS 42 (ZSOS42) images.
Physical Branch Connector Appliances:

Gateway mode: Most physical Branch Connector appliances deployed in gateway mode have already been upgraded to ZscalerOS 42 (ZSOS42) automatically. The exception is tenants for which an upgrade block was requested through Zscaler Support. If an upgrade block is in place on your tenant, contact Zscaler Support to have it removed so the appliances can be upgraded before December 31, 2026. To check which version your appliance is currently running, see How to validate if a Zscaler VM is running ZSOS24 and needs redeployment.

One-Armed mode: Physical Branch Connector appliances deployed in One-Armed mode are not upgraded automatically. These appliances must be upgraded to ZSOS42 manually by redeploying them before December 31, 2026. For the procedure, see Redeploying hardware Branch Connector in One-Armed mode (non-gateway mode).

Zscaler strongly recommends auditing active connector deployments immediately, updating deployment automation templates, and initiating branch hardware migration planning well in advance of December 31, 2026.

Why Deployments Running ZSOS24 Are In Scope

Operating System Lifecycle Retirement: ZSOS24 has reached the conclusion of its development and security maintenance cycle. Subsequent security vulnerabilities, compliance hardening, cryptographic updates, and feature enhancements are developed exclusively on ZSOS42 and modern platform baselines.
Architecture and Partitioning Changes (Virtual): The shift from ZSOS24 to ZSOS42 introduces an updated disk partitioning scheme and underlying filesystem modifications that cannot be applied dynamically to existing virtual disks, requiring clean instance provisioning.
Support Policy: After December 31, 2026, Zscaler Support and Engineering will no longer provide hotfixes, maintenance patches, or issue investigations for systems running ZSOS24.

Potential Impact If No Action Is Taken

Virtual Cloud and Branch Connector Appliances (ZSOS24)

Security & Compliance Deficits: Virtual instances remaining on ZSOS24 after December 31, 2026, will not receive OS-level vulnerability fixes, leaving workloads exposed and potentially out of compliance with regulatory standards.
Control-Plane and Feature Incompatibility: As the Zscaler Zero Trust Exchange continues to modernize communication protocols and forwarding services, legacy ZSOS24 nodes risk operational degradation or loss of synchronization.
Support Remediation Requirements: For support cases opened after the EOL date, customer support will require immediate redeployment to a supported ZSOS42 release as a prerequisite for assistance.

Deployment Automation & CI/CD Pipelines

Unmodified Terraform definitions, CloudFormation stacks, and ARM/Bicep templates referencing ZSOS24 image identifiers will spin up unsupported, non-compliant virtual instances.

Required Action: Migration and Redeployment Procedures

Administrators must inventory all running appliances across public cloud environments, local hypervisors, and physical branch sites, executing the appropriate procedure for each form factor.

Determine Active ZSOS Software Versions

Administrators can determine the installed ZscalerOS version by accessing the Cloud Service Provider console or via SSH to the instance. Detailed validation instructions are available on the Zscaler Community:

Guide for Cloud Connectors
Guide for Branch Connectors

Redeployment Procedure for Virtual Appliances (Cloud & Branch Connectors)

Virtual Cloud Connectors and Branch Connectors running ZSOS24 must be redeployed using official ZSOS42 images, as in-place OS upgrades are not supported. For step-by-step validation and migration instructions, refer to the Zscaler Community Migration Guide.

Update Infrastructure as Code (IaC) Templates

Update all Terraform modules (terraform-azurerm-cloud-connector-modules, AWS/GCP modules), CloudFormation scripts, and ARM/Bicep templates to reference active ZSOS42 image URNs or AMIs.
Update auto-scaling configurations and launch templates for Virtual Machine Scale Sets (VMSS) and Auto Scaling Groups (ASG) to prevent new deployments of legacy images.

Migration Procedure for Physical Branch Appliances (Transition to Zero Trust Branch)

Physical Branch Connector hardware appliances cannot be upgraded to ZSOS42. Organizations must transition physical sites to Zero Trust Branch:

Transition Path to Zero Trust Branch (ZTB):
Deploy native Zero Trust Branch hardware appliances to replace physical Branch Connectors at designated branch offices and campus environments.
Zero Trust Branch appliances natively connect users, servers, and IoT/OT devices to the Zero Trust Exchange without requiring local routable overlays or legacy hub-and-spoke topologies.
Modernization Advantages:
Eliminates complex branch site-to-site VPN tunnels and traditional SD-WAN hardware sprawl.
Delivers least-privilege, direct-to-cloud zero trust access for all branch traffic.
Simplifies ongoing lifecycle management through centralized, cloud-native administration.
Action Required:
Engage your Zscaler Account Team or Solutions Architect to assess site requirements and coordinate the acquisition, sizing, and deployment schedule for Zero Trust Branch hardware before the December 31, 2026 deadline.

Key Dates and Deadlines

Date	Milestone / Event
September 2026	Formal EOL Customer Advisory published. Fleet inventory audit begins; Zero Trust Branch hardware planning commences.
October 1 – November 30, 2026	Recommended window to complete virtual appliance blue-green redeployments to ZSOS42 and roll out Zero Trust Branch hardware across physical sites.
December 15, 2026	Target cutoff for updating all deployment automation, IaC templates, and decommissioning legacy ZSOS24 nodes.
December 31, 2026	End-of-Life (EOL) & End-of-Support for ZscalerOS 24 (ZSOS24). Software support, security patches, and issue investigations for ZSOS24 end permanently.

Caveats and Considerations

Hardware Procurement Lead Times: Because physical branch connectors must be replaced with Zero Trust Branch appliances, account for hardware supply chain, shipping, and on-site cutover timelines well prior to the December 31, 2026 deadline.
Virtual Appliance Sizing: Verify that host hypervisors and cloud virtual machine SKUs satisfy minimum vCPU, memory, and interface specifications for ZSOS42 images.
Coexistence Period: Ensure adequate cloud quota or hypervisor capacity during the transitional blue-green phase while both old and new virtual appliances run concurrently.

Long-Term Resolution

Redeploying virtual Cloud and Branch Connectors to ZscalerOS 42 establishes a modern, performant, and secure OS baseline aligned with modern enterprise standards and upcoming Zero Trust Exchange capabilities.

For physical branch sites, transitioning to Zero Trust Branch provides a comprehensive architecture that retires legacy branch hardware constraints, completely eliminating traditional networking overhead in favor of pure zero trust direct-to-cloud connectivity.

References

End of Support for ZSOS24 on Cloud Connector Deployments
End of Support for ZSOS24 on Branch Connector Deployments
Zscaler Documentation:
Cloud & Branch Connector Release Notes and Upgrade Summaries
Zero Trust Branch Architecture and Deployment Overview
Deploying Cloud Connector in AWS, Microsoft Azure, and Google Cloud Platform
Deploying Virtual Branch Connector on VMware ESXi, Linux KVM, and Microsoft Hyper-V

Decommissioning "Original" Navigation on Experience Center - zscaler.net, zscalerone.net, zscalertwo.net, zscloud.net, zscalerthree.net, private.zscaler.com, zdxcloud.net, zpatwo.net

Wed, 23 Sep 2026 00:00:00 GMT

The Original Navigation for Experience Center, launched in October 2024, is being decommissioned. A new and improved navigation experience reached General Availability on September 15, 2026, and will fully replace the original.

What is changing?

Starting September 21, 2026, all Experience Center customers will be defaulted to the new navigation. During the transition period, administrators have the option to toggle between the new and original navigation via the Account Settings page. This flexibility will remain available until October 29, 2026, after which the toggle will be permanently removed and all customers will be on the new navigation exclusively.

Who is impacted?

All customers using Experience Center will transition to the new navigation. It is important to note that this change affects navigation and layout only — specifically, how administrators access existing pages. No underlying content, features, or functionality is being modified or removed.

What are the next steps?

No action is required from administrators. The transition to the new navigation will happen automatically. Administrators who wish to familiarize themselves with the new experience ahead of the October 29, 2026 deadline are encouraged to explore it via the Admin Preference page before the toggle is removed.

Traffic Congestion Affecting US–APAC and Intra-APAC Routes - zscaler.net, zscalerone.net, zscalertwo.net, zscloud.net, zscalerthree.net, private.zscaler.com, zpatwo.net

Mon, 21 Sep 2026 00:00:00 GMT

Zscaler has detected network congestion affecting US–APAC and intra-APAC routes. This is attributed to subsea cable damage, which has reduced available capacity and increased congestion across the remaining active routes.

Customers currently experiencing impact should redirect traffic or fail over to a secondary or alternate data center that does not use the affected network routes. For more information, please refer to the following support article.
Customers experiencing issues with ZPA should contact Zscaler Support for assistance.

Latest Update - Tue, 13 Oct 2026 04:57:36 UTC

Zscaler can confirm that the connectivity disruption affecting the ADC subsea cable route has been fully resolved. The network provider has completed all necessary restoration work on the affected infrastructure, and network services have been confirmed restored. Zscaler has validated recovery and continues to monitor network conditions to ensure sustained stability.

Update - Tue, 29 Sep 2026 20:05:07 UTC

We are monitoring multiple regional and subsea network faults impacting some APAC international routes. These include the ADC cable disruption reported on September 21, currently expected to be repaired by October 2, 2026, along with other regional faults expected to recover through October. Carriers have optimized their APAC traffic as much as possible for the time being. Conditions are currently stable, but transient periods of congestion, packet loss, and higher-than-normal RTT may occur over the next few weeks, especially during peak periods. Impact varies by provider, route, and customer traffic path. Zscaler continues to monitor and optimize routing where possible. For any issues, please contact Support with bi-directional MTRs and customer IPs so the path can be reviewed and optimized where possible.

Update - Fri, 09 Oct 2026 22:14:32 UTC

The network provider reports that the ADC subsea cable repair is complete, with final supplier confirmation pending. Zscaler has observed improved connectivity following provider routing adjustments and continues to monitor network conditions and review customer feedback. Zscaler will provide updates as further information is confirmed. Customers experiencing continued impact should contact Zscaler Support for assistance or use an alternate data center with unaffected routes, where possible.

Update - Tue, 13 Oct 2026 04:57:36 UTC

Zscaler is upgrading PRA services to comply with SSL 3.5 standards - private.zscaler.com, zpatwo.net, zpabeta.net

Fri, 18 Sep 2026 00:00:00 GMT

Description:

Zscaler is upgrading PRA services to comply with SSL 3.5 standards.

Timeline:

Upgrade will commence from 24th September 2026 during respective maintenance windows.

How does this affect me?

This will impact RDP console connectivity via PRA to older Windows Server versions, which supports only SSL 1.0.X.

Windows Server 2003, 2008, 2008 R2, 2012, or 2012 R2 are the highest-risk versions. Windows Server 2016 and later usually negotiate TLS 1.2/1.3 and are not affected by this specific failure.

What action is required if I use PRA RDP with older Windows Servers?

In the ZPA Admin Portal, change the affected Application Segment's Connection Security to "RDP". This forces Standard RDP Encryption and bypasses the TLS handshake that OpenSSL 3.5 cannot complete with those legacy servers.

You may refer this help article to perform these changes- https://help.zscaler.com/zpa/configuring-defined-application-segments#PRAsteps

Expected error on RDP console-

The PRA console will show a red banner with below message when the guacd/OpenSSL 3.5 client cannot complete the TLS handshake with the Windows RDP server:

SSL/TLS connection failed (untrusted/self-signed certificate?)

What if I have more questions?

If you have additional questions, contact Zscaler Support via the Support link in the Admin Portal.

Zscaler Client Connector Support of Windows 10 after Microsoft EOS in October - zscaler.net, zscalerone.net, zscalertwo.net, zscloud.net, zscalerthree.net, private.zscaler.com

Fri, 11 Sep 2026 00:00:00 GMT

Microsoft has announced on their Support page that support for Windows 10 will end on October 14, 2025. Zscaler Client Connector and Zscaler Client Connector for VDI will continue supporting Windows 10 for 12 months after this date, until October 13, 2026. Note that customers remaining on Windows 10 after October 14, 2025 can continue receiving security patches from Microsoft after October 14, 2025 through Microsoft’s Extended Security Update (ESU) program. Beyond October 13, 2026, there might be fundamental issues preventing Client Connector from working with Windows 10 and you might be required to upgrade to a supported Windows version to continue uninterrupted protection by Zscaler Zero Trust.

Zscaler will continue to support issues reported on Windows 10 devices and will not prevent those devices from enrolling. However, if an issue depends on Microsoft and is outside of Zscaler’s control, a resolution may not be possible.

What is changing?
Zscaler support for Windows 10 for both Zscaler Client Connector and Zscaler Client Connector for VDI will end on October 13, 2026. After that date, we will continue to provide best-effort support for currently supported Client Connector versions, up to and including Zscaler Client Connector version 4.9. Zscaler Client Connector version 5.0 and later will no longer support Windows 10. To maintain support for the longest possible period, customers should upgrade to Zscaler Client Connector version 4.9, our next long-term support (LTS) release.

Who is impacted?
Customers using Zscaler Client Connector or Zscaler Client Connector for VDI on Windows 10.

What are my next steps?
Zscaler recommends reviewing the information on the Zscaler Client Connector Supported Versions page and upgrading client devices to supported operation system versions for uninterrupted protection by Zscaler Zero Trust.

What if I have more questions?
If you have additional questions, contact Zscaler Support via the Support link in the ZIA Admin Portal or call us at +1 (844) 971-0010.

Microsoft 365 Copilot Changes and Impacts to Zscaler One Click - zscaler.net, zscalerone.net, zscalertwo.net, zscloud.net, zscalerthree.net, private.zscaler.com, zdxcloud.net, zpatwo.net

Sat, 05 Sep 2026 00:00:00 GMT

Microsoft is making changes to the integrated M365 Copilot experience over the month of September 2026 as part of their continued updates to the corporate, personal, and educational versions of the M365 service. These updates continue the pattern of increased integration of Copilot within various features of M365 but now start to unify these interactions under their .copilot.cloud.microsoft FQDN endpoint.

Zscaler will continue to exclude the Copilot cloud application from our M365 One Click so that TLS (SSL) decryption occurs by default and visibility and inspections continue for data security, AI security, advanced threat protections, cloud/SaaS app controls, URL categorization and more can be fully performed according to customer security policy on M365 traffic transiting the Zscaler Zero Trust Exchange.

Zscaler does not anticipate any significant impact to the M365 Copilot service. Microsoft’s planned increase in unification under the .copilot.cloud.microsoft FQDN endpoint will mean that some Copilot experiences will result in more Zscaler security inspections as part of M365 Copilot traffic. It is hereby advised to continue to monitor and evaluate that all configured policy within Zscaler continues to ensure it matches corporate security and risk goals during this period of M365 change by Microsoft.

Zscaler is well prepared in terms of capacity and efficacy to handle any increase in volume as a result of ongoing changes by Microsoft and are committed to our partnership with Microsoft to ensure the best user experience with the M365 service globally. Zscaler is also committed to our mission of ensuring that the configured customer security policies are fully applied to all customer traffic transiting the Zscaler Zero Trust Exchange.

For any issues, please contact Zscaler Support.

References

Zscaler Help: Understanding Microsoft 365
Zscaler Help: Understanding Microsoft One-Click Options
Microsoft announcement: MC1462915
Microsoft guidance: Overview of the cloud.microsoft domain

Connectivity degradation affecting some users in the Los Angeles and Southwestern United States - zscaler.net, zscalerone.net, zscalertwo.net, zscloud.net, zscalerthree.net, private.zscaler.com, zpatwo.net

Wed, 02 Sep 2026 00:00:00 GMT

Zscaler is aware of reports that some Zscaler Private Access (ZPA) and Zscaler Internet Access (ZIA) users in the Los Angeles and Southwestern United States may be experiencing increased latency, intermittent connectivity, or connection timeouts.

The issue began at approximately September 2 at 19:30 UTC and has been correlated with network degradation affecting certain traffic paths traversing the Cogent network. Cogent has reported fiber disruptions affecting connectivity in the Los Angeles and Southwestern United States areas.

Zscaler service components remain operational. The observed impact is associated with the external network condition described above.

Customer Workarounds

Customers experiencing the issue may consider the following options, where available:

Use an alternate ISP or network path that does not traverse the affected Cogent routes.
Customers with redundant network connectivity may route traffic through an unaffected ISP.
ZPA customers with geographically redundant App Connectors may temporarily avoid App Connectors whose upstream connectivity is affected by Cogent.
Customers who receive service directly from Cogent should engage Cogent for additional information regarding the underlying network disruption and restoration status.

Zscaler continues to monitor reported customer impact and will provide additional updates as new information becomes available.

Update - Thu, 03 Sep 2026 18:15:23 UTC

Cogent has reported network availability restored in the Los Angeles and Southwestern United States as of September 3 at 09:11 UTC. Affected ZPA and ZIA connectivity should now be restored. This advisory is resolved.

Advanced Sandbox: Patient Zero Alert Changes - zscaler.net, zscalerone.net, zscalertwo.net, zscloud.net, zscalerthree.net

Fri, 28 Aug 2026 00:00:00 GMT

Zscaler is updating several items related to the ZIA alert engine and Sandbox Patient Zero alert delivery.

Deployment Schedule (Estimated):

Zscaler Cloud	Date	Time (PDT)
Zscloud.net	August 29th, 2026	6:00 PM
Zscaler.net	August 29th, 2026	6:00 PM
Zscalerone.net	August 29th, 2026	6:00 PM
Zscalerthree.net	August 29th, 2026	6:00 PM
Zscalertwo.net	August 29th, 2026	6:00 PM

Please note that these are estimated start times and are subject to change due to unforeseen circumstances.

What is Changing:

The ZIA alert engine data source is being changed from Hadoop to Zscaler Data Fabric.
The URL seen by users when opening an alert from an email notification will change structure:
- Historical: https://admin.zscalertwo.net/#insights/web/logs/1234
- New: https://admin.zscalertwo.net/#insights/web/logs/4262132481059456499 (BIGINT/Long format of alert id)
The number of Patient Zero alerts received by subscripted users may increase
- This is due to the addition of a new 24 hour lookback period and secondary data source to ensure all alerts are triggered and notifications are sent.

Who is Impacted:

Customers utilizing the Advanced Sandbox Patient Zero Alert with email based notifications.

What are My Next Steps:

None, this notification is just informational and no customer action is required for any change outlined in this trust post.

What if I Have More Questions:

For additional questions, please contact Zscaler Support through the Support link in the Admin Portal or call us at 1-844-971-0010.

Migrate ZPA VPN Service Edge/s from UAE-Dubai to other alternative regions. - private.zscaler.com, zpatwo.net, zpabeta.net

Mon, 17 Aug 2026 00:00:00 GMT

As AWS continues to report impairment in two Availability Zones (mec1-az2 and mec1-az3) in the AWS ME-CENTRAL-1 Region, customers with ZPA VPN Service Edge/s deployed in UAE-Dubai region are required to migrate their instances (i.e., delete and add new VPN Service Edge) to alternate regions.

Zscaler has also restricted all new VPN Service Edge deployments in UAE-Dubai region until AWS services are completely restored.

Customers may refer to the cloud provider’s status page for additional updates related to the underlying infrastructure Status Page.

Zscaler continues close monitoring of the situation and will provide further updates as additional information becomes available or once full service stability is confirmed. Customers requiring assistance are encouraged to contact Zscaler Support for further guidance.

Announcing withdrawal of select Linux Client Connector Debian packages - zscaler.net, zscalerone.net, zscalertwo.net, zscloud.net, zscalerthree.net, private.zscaler.com, zdxcloud.net, zpatwo.net

Fri, 14 Aug 2026 00:00:00 GMT

It was discovered recently that the expiry of a package-signing key was causing a recent set of Debian-based packages for certain Linux Client Connector versions to reject Zscaler package updates. As a result, any of the Debian installations for the Linux Client Connector versions listed below will not receive automatic upgrades of new versions starting with 4.2.2. Once that key expired, clients began treating package signatures as invalid, even for packages that were signed successfully before the expiration date and had previously installed just fine.

The affected Debian packages are the refresh releases made available in June and July: 4.2.1.64, 4.2.1.114, 4.2.1.122, 3.7.2.64, 3.7.2.70, 3.7.2.76. Therefore all devices running these builds that were installed via the Debian package (e.g. 4.2.1.122-1_amd64.deb) will not be able to be automatically upgraded to future builds. Note that the builds themselves work fine after they were installed. The only problem is that these builds won't auto upgrade successfully and manual installation is required to upgrade them to newer releases. A fix and new Debian packages for the refresh releases of the above versions will be provided over the next week.

What is changing?

To prevent more customers from installing these builds and encountering this problem, the following packages are no longer available for download:

Linux 4.2.1.64 (.deb package)
Linux 4.2.1.114 (.deb package)
Linux 4.2.1.122 (.deb package)
Linux 3.7.2.64 (.deb package)
Linux 3.7.2.70 (.deb package)
Linux 3.7.2.76 (.deb package)

Who is impacted?

Customers running any of the Linux Client Connector versions that were installed via the Debian (.deb) packages: 4.2.1.64, 4.2.1.114, 4.2.1.122, 3.7.2.64, 3.7.2.70, 3.7.2.76 .

When is the update scheduled?

These Debian packages have already been removed and are no longer available for download.

What are my next steps?

Discontinue installing any of the affected Debian packages noted above. Look forward to new Debian packages for refresh builds of these affected versions being made available over the next week. When those are available, you will need to install them manually.

What if I have more questions?

If you have additional questions, contact Zscaler Support via the Support link in the ZIA Admin Portal or call us at +1 (844) 971-0010.

Planned Upgrade to Experience Center | Action Required for Eligible Customers - zscaler.net, zscalerone.net, zscalertwo.net, zscloud.net, zscalerthree.net, private.zscaler.com, zdxcloud.net, zpatwo.net, zpabeta.net, zslogin.net

Wed, 12 Aug 2026 00:00:00 GMT

Starting Sep 6, a subset of Zscaler customers are scheduled for an automatic upgrade to Experience Center, a unified console for managing Zscaler products, policies, and security analytics. This has been communicated through emails and in-product banners to this cohort.

Recommended: Self-initiate the upgrade before Sep 6 to avoid disruption. Contact your Zscaler Account team or Zscaler Support to upgrade on your preferred schedule.

What changes after automatic upgrade:

Legacy IdP admin access is discontinued; admins will be registered as hosted admins in Authentication Service.
All admins must enroll in Zscaler-hosted multi-factor authentication (MFA) to access the new Zscaler Admin Console.
IdP can be reconfigured in Authentication Service post the migration.
End users will not be impacted. Access to Internet & SaaS (ZIA) and Private Access (ZPA) remains uninterrupted.

If no action is taken, Zscaler will automatically upgrade your organization starting Sep 6, 2026.

Update to AI/ML Content Categorization for Miscellaneous and Unknown URLs - zscaler.net, zscalertwo.net, zscloud.net, zscalerthree.net

Mon, 10 Aug 2026 00:00:00 GMT

Context-Aware Model Upgrade

To improve classification accuracy and expand categorization coverage for URLs that are not currently categorized in the Zscaler primary database, Zscaler has updated the existing AI/ML-based content categorization capability for Miscellaneous and Unknown inline URLs. This capability is available to customers who have enabled the feature in their tenant and has been used to classify eligible inline uncategorized URLs for some time. This update introduces a more context-aware classification model.

This enhancement is designed to reduce the footprint of categorized URLs in your organizations traffic by providing more precise categorization where sufficient signals are available.

Key Enhancements

New Context-Aware AI/ML Module: Improved inference using additional contextual signals to better categorize previously Miscellaneous/Unknown inline URLs.

Enhanced Coverage: More URLs that previously remained Miscellaneous/Unknown may now be mapped to a specific predefined category.

Improved Classification Accuracy: More precise categorization for ambiguous and hard-to-classify URLs compared to the prior model behavior.

Impact & Required Action

Scope: This change impacts only customers/tenants who have enabled the AI/ML-based content categorization option for Miscellaneous and Unknown URLs. This change does not affect URLs that are already categorized under predefined categories.

Expected Change in Behavior: Customers may observe category changes for some URLs that were previously classified as Miscellaneous/Unknown. As a result, existing URL filtering policies may produce different allow/block outcomes if the newly assigned category is blocked or allowed by policy.

Recommended Review: Customers can review their logs to identify miscellaneous URLs that are important to their organization and users, and request manual category updates where needed.

If Inaccurate Categorization is Observed: Customers should report the affected URLs to Zscaler Support for validation and review. Confirmed feedback may be used to tune the AI/ML categorization model and improve future classification accuracy.

Customer Mitigation Option: If the change is significantly affecting browsing experience or policy outcomes, customers can disable the feature toggle in the admin portal:
Configuring Advanced Policy Settings

Note: Disabling the feature may result in a higher volume of Miscellaneous/Unknown URL transactions for sites not currently categorized in ZURLDB.

Supporting Process / Escalation Path

To support investigation and tuning, please share the following when reporting suspected inaccurate categorizations:

Example URL(s) and observed category
Expected category, if known
Tenant ID / time-frame of observation
Policy impact observed, such as unexpected block/allow

Availability and Rollout Status

This update becomes effective based on tenant configuration and applies only where AI/ML categorization for Miscellaneous/Unknown URLs is enabled in the tenant.

Cloud	Date
zscaler.net	Rollback
zscloud.net	Postponed
zscalertwo.net	Postponed
zscalerthree.net	Postponed

Benefits of this Change

This enhancement enables Zscaler to:

Improve categorization accuracy and coverage for uncategorized or broadly categorized URLs.
Reduce the number of transactions logged as Miscellaneous or Unknown where better classification is possible.
Provide more consistent policy outcomes for customers using AI/ML categorization for Miscellaneous/Unknown URLs.

For further questions or to report suspected inaccurate categorizations, please contact Zscaler Support at:
Contact Zscaler Support

Third-Party Vendor Incident (Snowflake) - app.avalor.io

Mon, 03 Aug 2026 00:00:00 GMT

Zscaler is aware of service impact stemming from an incident affecting our third-party vendor, Snowflake. Customers may experience disruptions with analytics and reporting capabilities that depend on Snowflake.

Snowflake is actively engaged in remediation efforts. For the most current updates, please refer to Snowflake’s status page

Update - Sun, 09 Aug 2026 09:14:37 UTC

Snowflake took necessary actions to resolve this issue. For latest updates, please refer to Snowflake’s status page

Opt Out of Microsoft Azure Network Adapter (MANA) for Zscaler ZPA Private Infrastructure Deployed in Microsoft Azure - private.zscaler.com, zpatwo.net, zpabeta.net

Tue, 28 Jul 2026 00:00:00 GMT

Microsoft is currently deploying the Microsoft Azure Network Adapter (MANA), a next-generation network interface included within Azure Boost, across existing Azure virtual machine (VM) size families. This deployment will replace the Mellanox ConnectX-based Accelerated Networking hardware currently utilized by ZPA App Connector, Private Service Edge, Network Connector, and Private Cloud Controller. Effective August 1, 2026, Azure may automatically transition MANA-eligible VMs to MANA-capable hardware during routine lifecycle events, unless an explicit opt-out is configured.

Zscaler formally recommends that all customers implement Microsoft's MANA opt-out configuration (via the LegacyVMNVA tag) across all Azure resource groups, virtual machines (VMs), and VM Scale Sets hosting ZPA App Connectors, Private Service Edges, Network Connectors, and Private Cloud Controllers prior to August 1, 2026.

Pending Zscaler's official announcement regarding Microsoft Azure Network Adapter (MANA) driver support for these components, it is imperative that all ZPA private infrastructure instances continue to utilize Mellanox-based Accelerated Networking. This configuration remains the established, validated methodology for these deployments. Zscaler is currently engaged in the active development of comprehensive MANA driver support.

Why ZPA Private Infrastructure Is In Scope

Accelerated Networking is not enabled by default on ZPA App Connector, Private Service Edge, Network Connector, and Private Cloud Controller deployments in Azure. If you have explicitly enabled Accelerated Networking, you should opt out.
VM instance size check: If the VM instance sizes currently deployed fall within Microsoft's MANA-eligible classification, they are considered part of the MANA deployment and should also be opted out in accordance with Microsoft's guidance.

Potential Impact If No Action Is Taken

Currently Active Instances (Deployed prior to August 1, 2026):

These instances are currently deployed on non-MANA hardware.
Subsequent to August 1, 2026, any lifecycle event (such as stop/start, redeploy, or reapply) may result in the VM being allocated to MANA-enabled hardware.
In the event that the VM is placed on MANA-enabled hardware, Zscaler applications will fail to initialize on that instance.

Currently Active Virtual Machine Scale Sets (VMSS):

Instances within a VMSS are currently deployed on non-MANA hardware.
Following August 1, 2026, any lifecycle event at the VMSS level (Scale-Out, Scale-In) or at the individual instance level (stop/start, redeploy, or reapply) may cause the VM to be provisioned on MANA-enabled hardware.
If any VM within a VMSS is allocated to MANA-enabled hardware, Zscaler applications will fail to initialize on that specific VM.

Newly Deployed Instances (With or Without Scale Sets):

If a new deployment is allocated to MANA-enabled hardware, Zscaler applications will fail to initialize on those instances.

Required Action before Aug 1, 2026: Apply the Microsoft Opt-Out

Apply Microsoft's LegacyVMNVA opt-out configuration by adhering to the official guidance: MANA support for Network Virtual Appliances (NVAs).

At scale (recommended) Assign Microsoft's built-in LegacyVMNVA Azure Policy, incorporating compliance remediation, across all subscriptions or resource groups that contain these components. This policy applies the tag to both individual VMs and Virtual Machine Scale Sets. Microsoft advises assigning the built-in policy as-is to ensure that subsequent updates are automatically propagated.
Individual VMs Apply the LegacyVMNVA tag, requiring no associated value, to each individual App Connector, Private Service Edge, Network Connector, and Private Cloud Controller VM.
Provided that the VM is currently executing on non-MANA-enabled hardware, the presence of this tag guarantees that the instance will persist on non-MANA-enabled infrastructure during any subsequent lifecycle events.
VM Scale Sets Apply the LegacyVMNVA tag to the scale set model. For existing instances, update the tag separately using:

az vm update --resource-group <rg-name> --name <instance-name> --set tags.LegacyVMNVA='"true"'

Alternatively, a rolling instance replacement subsequent to tagging the model achieves an identical outcome. Verify that instances generated by scale-out events after tagging inherit the tag.

Infrastructure as Code If you deploy these components via Zscaler Terraform modules or your own templates, add the LegacyVMNVA tag to your VM and VMSS resource definitions so that all future deployments and scale-out instances carry the tag from creation. VMs created after August 1, 2026 without the tag may be placed directly on MANA-capable hardware.

Verification

Confirm the LegacyVMNVA tag is visible on each App Connector, Private Service Edge, Network Connector, and Private Cloud Controller VM and VMSS in the Azure portal.
Azure Advisor raises recommendations against affected NVAs; use it to identify untagged instances.
If you suspect an instance has already been placed on MANA hardware (indicated by a MANA Virtual Function visible to the guest), contact Zscaler Support for verification, apply the tag, and perform a stop/deallocate/start to return the instance to Mellanox-based hardware.

Recovery Steps if Impacted:

These recovery operations are exclusively applicable to a VM subsequent to its allocation to MANA-capable hardware. If the opt-out configuration has been properly implemented, these VMs will be completely precluded from being placed on MANA-enabled hardware.

Apply the opt-out tag:

az vm update -g <resource group name> -n <vm instance name> --set tags.LegacyVMNVA=""

Deallocate:

az vm deallocate -g <resource group name> -n <vm instance name>

Start:

az vm start -g <resource group name> -n <vm instance name>

How to check if a ZPA VM is placed on MANA-enabled hardware

On these Linux-based instances, a MANA Virtual Function is visible to the guest under Microsoft vendor ID 0x1414. Run:

lspci -nn | grep -i '1414:00ba'

A returned device (Microsoft Corporation, class Ethernet) indicates MANA placement. You can also confirm the interface driver:

lspci -nnk | grep -iA3 '1414:00ba'

A driver of mana (rather than mlx5_core) confirms the instance is on MANA hardware.

Key Dates (Azure Public Cloud)

Date	Event
May 26, 2026	Azure began placing Intel v5 and Cobalt 100 v6 family VMs on MANA-capable hardware in select regions. If you run these components on v5/v6 sizes, apply the opt-out immediately.
July 31, 2026	Deadline to apply the opt-out (or be MANA-ready) for Intel v1–v4 families.
August 1, 2026	All listed VM families become eligible for MANA placement. VMs created or tagged after this date may be placed on MANA-capable hardware.
May 31, 2027	The LegacyVMNVA opt-out sunsets. From June 1, 2027, all MANA-eligible VMs may be placed on MANA-capable hardware regardless of tagging.

Caveats and Additional Notes

On-Demand Capacity Reservations (ODCR): Applying LegacyVMNVA to VMs under an ODCR reduces the available capacity pool for placement, and ODCR SLA guarantees do not apply to those VMs while tagged.
The opt-out mechanism is proprietary to and maintained exclusively by Microsoft. For technical errors encountered during enforcement of the Azure Policy or configuration of the tag, contact Microsoft Azure support. For inquiries pertaining to ZPA component operational behavior or performance, contact Zscaler Support.
The opt-out mechanism is temporary and does not constitute a permanent exemption. Utilize the period prior to May 31, 2027, to plan migration to MANA-validated software (referenced below).

Long-Term Resolution

Zscaler is currently collaborating with Microsoft to validate the MANA driver stack for ZPA App Connector, Private Service Edge, Network Connector, and Private Cloud Controller. Announcements regarding MANA support will be disseminated via the respective component release notes. Upon availability of a MANA-validated release, customers should plan to upgrade to that version or later prior to the May 31, 2027 opt-out sunset, after which all MANA-eligible VMs will be transitioned to MANA-capable hardware.

References

Microsoft: MANA support for Network Virtual Appliances (NVAs) - opt-out guidance
Microsoft: Microsoft Azure Network Adapter (MANA) overview
Microsoft: Announcing MANA support for existing VM SKUs