* Fixes an issue on iOS 26 where Zscaler Client Connector remained stuck in an authentication loop while authenticating through an SSO extension for several minutes before completing sign-in. * Fixes an issue where devices connected to IPv6-only networks and in tenants without the IPv6 feature enabled for Zscaler Client Connector fell back to Zscaler Tunnel (Z-Tunnel) 1.0, because the QUIC drop policy wasn't applied. * Fixes an issue where after a device reboot on a cellular-only network, traffic intermittently failed to route through the Zscaler Internet Access (ZIA) tunnel. * Fixes an issue where Zscaler Client Connector displayed the message Invalid MDM Config, when Zscaler Digital Experience (ZDX) remained stuck in a connecting state due to an incorrect management device management (MDM) configuration.

* Supports ZIdentity integration for the following features: using one-time passwords (OTPs), using device group-based app profiles, the assignment of service entitlements based on device posture, quarantining devices, displaying the service disable reason, and force-removing devices. * Supports end user migration to ZIdentity, including a new Migration Status filter on the Device Management page and the Platform Details page to help track the device migration progress. To learn more, see Migrating End Users to ZIdentity. * Provides separate per-device OTPs for the logout function and Disable ZIA, Disable ZPA, and Disable ZDX services. * Updates the External Device ID field, displayed in the Zscaler Client Connector Registered Devices page in Enrolled Devices, upon a change by the Mobile Device Management (MDM). * Enables admins to configure an early reauthentication notification for end users before Zscaler Private Access (ZPA) applications expire and allows users to authenticate before ZPA applications expire. To learn more, see Configuring Zscaler Client Connector App Profiles. * Adds the ability to display a custom notification to users who attempt to access the internet when in Strict Enforcement mode. * Supports device group-based app profiles in the Zscaler Client Connector Portal. * Disables captive portal notifications based on the disableCaptivePortalNotification parameter in the Mobile Device Management (MDM) VPN configuration. * Fixes an issue where strict enforcement failed to apply PAC file bypasses after a device reboot, requiring users to update the policy as a workaround. * Fixes an issue where internet connectivity was lost after a device reboot when ZPA was disabled in a per-app VPN configuration for ZPA and Zscaler Internet Access (ZIA). * Fixes an issue for ZPA Private Service Edge deployments only where the Certificate Trust posture check appears to have failed because Zscaler Client Connector took too long to send the posture evaluation results to the ZPA Private Service Edge.

* Fixes an issue that caused delayed status updates in the Zscaler Client Connector interface after launching Zscaler Client Connector. * Fixes an issue where constant mobile carrier connection timeouts caused high cellular data usage. You can push the ZpaSocketReadTimeout (in seconds) in the VPN profile to enable more frequent keepalives. * Fixes an issue where the Zscaler Tunnel (Z-Tunnel) 2.0 connection failed on a private cloud instance when switching from Wi-Fi to cellular data. * Fixes an issue where Zscaler Private Access (ZPA) application access was delayed or failed after switching from Wi-Fi to cellular data. * Fixes an issue that caused DNS resolutions to fail for a brief period of time when switching between Wi-Fi and cellular data. * Fixes an issue that prevented access to websites from the app defined in the Per-App VPN profile when using Z-Tunnel 2.0 with Redirect Web Traffic to Zscaler Client Connector Listening Proxy enabled in Forwarding Profile in a dual-tunnel deployment.

* Fixes an issue where mobile users lost connection to Zscaler Internet Access (ZIA) after switching from Wi-Fi to mobile data access where the carrier’s interface also uses the same NAT address range (100.64.x.x/12) as Zscaler Client Connector. * Fixes an issue where some users experienced recurring connectivity issues due to IPv6 traffic on an IPv4-only stack and vice versa.. * Fixes an issue where the UI update was delayed after starting Zscaler Client Connector

* Fixes an issue where some users connecting to hotel guest Wi-Fi received a captive portal 403 error after clicking Open Browser in Zscaler Client Connector. * Fixes an issue where after a network change, the DNS IP address was returned from the previous network for a few seconds, causing DNS traffic failure. * Improves Z-Tunnel connection and disconnection notifications when logging in to Zscaler Client Connector. * Fixes an issue where users couldn’t open a browser after clicking Open Browser when Zscaler Client Connector detected a captive portal. * Fixes an issue which caused Zscaler Client Connector to crash when trying to display the SAML IdP login page for ZIdentity users. * Fixes an issue where an invalid configuration caused the tunnel to continuously restart. * Fixes an issue where users connected using a mobile hotspot received the error message Captive Portal Detected, followed by the message Connection Error, while connected to Zscaler Internet Access (ZIA).

Bug fixes and improvements

* Supports Device Groups and the assignment of service entitlements based on device posture. To learn more, see Enabling Device Groups. * Includes support to show the Serial Number under Enrolled Device details. * Includes support for Disabling iCloud Private Relay in App Profiles. To learn more, see Configuring Zscaler Client Connector App Profiles. * Includes support for up to 50k ZPA Application Segments. Contact Zscaler Support to enable this feature. To learn more, see Ranges & Limitations. * Supports ZIdentity integration for the following features: Single-Sign On (SSO), Device Posture, ZIdentity as IdP, Strict Enforcement, and Multi-cloud selection. * Fixes an issue where users encountered a ZPA reauthentication error displaying the message Posture Version Mismatch. * Fixes an issue where traffic was being dropped incorrectly on interfaces with existing IP addresses in the Synthetic IP Range.

* Includes battery optimisation which fixes an issue that caused increased battery consumption * Fixes an issue where some websites failed to load after configuring per-app VPN access for Microsoft Edge or Chrome on iOS. * Fixes an issue where Zscaler Client Connector was stuck in a loop during the login process when strict enforcement is enabled with policy token, preventing successful authentication. * Fixes an issue where the External Device ID field was not visible in the Zscaler Client Connector Portal despite the device being registered. * Fixes an issue that prevented incoming Microsoft Teams calls from ringing or displaying notifications on iOS devices.

* Fixes an issue where customers experienced audio problems on MuPRO when Zscaler Client Connector was enabled on their devices. * Fixes an issue where Z-Tunnel 2.0 over custom port was not working. * Fixes an issue where SME Health Check probes for Z-Tunnel 2.0 were failing over custom ports. * Fixes an issue where ZPA Search Domains were being applied in reverse order on the Zscaler Client Connector network settings. * Fixes an issue where ZPA DNS search domains weren’t automatically appended when Z-Tunnel 2.0 DNS inclusions were used.

* Fixes an issue that caused intermittent loss of connectivity to some internal and internet applications when match domains were appended to search domains. * Includes optimisations for cpu and battery utilisations * Adds G2 Certificate support in Zscaler Digital Experience (ZDX). * Fixes an issue where, when strictEnforcement was enabled, the non-default app profile name did not display in the policy name. *Fixes an issue for the 3.8 SDK where some applications didn’t communicate through ZIA when the forwarding profile action for ZPA was set to None in Forwarding Profiles and VPN gateways were empty in App Profile. * Fixes an issue where, when strictEnforcement was enabled, the non-default app profile name did not display in the policy name.

* Fixes an issue where DNS didn’t work on a specific Wi-Fi network when the enforceRoutes option was used in the VPN profile configuration. * Fixes an issue where some users were prompted to reauthenticate on ZPA even after they had already authenticated. * Fixes an issue where strict enforcement with policy token didn’t work.

* Fixes an issue where Zscaler Digital Experience (ZDX) stayed in a connecting state after upgrading to Zscaler Client Connector version 4.3. * Fixes an issue where UDP communication over ZPA didn’t work after the SDK 3.8 upgrade. * Fixes enrollment failures experienced on Zscaler Client Connector version 4.3 for iOS. * Fixes an issue where users couldn’t access the internet after rebooting the device. * Fixes an issue where the ZDX window didn’t show on iOS devices after upgrading to Zscaler Client Connector version 4.3.

* Fixes an issue where ZPA only company users could not connect to private apps after upgrading to Zscaler Client Connector 4.3 * Fixes an issue where large number of ZPA domains blocked internet access

Includes support for Z-Tunnel 2.0 over TLS. Supports Z-Tunnel 2.0 IPv6 traffic for TLS on IPv6-enabled iOS devices. Enables customers to configure fallback options on Z-Tunnel 2.0 establishment failures. To learn more, see Configuring Forwarding Profiles for Zscaler Client Connector. Supports Zscaler Client Connector discovering the optimal path maximum transmission unit (MTU) for Z-Tunnel 2.0. Supports configuring dynamic Zscaler Internet Access (ZIA) Public Service Edge use based on latency settings for the probe interval, frequency, and threshold limits. Zscaler Client Connector supports inclusion and exclusion of DNS domains as part of Z-Tunnel 2.0 configuration. Adds optimizations to reduce the frequency of Strict Enforcement policy download requests on the Zscaler Client Connector Portal server. Adds a new option for the Z-Tunnel 2.0 protocol bypass feature, Redirect Web Traffic to Zscaler Client Connector Listening Proxy. Enhances the strict enforcement feature to block all ports and protocols. Includes support for policy token-based strict enforcement. Allows administrators to bypass the IdP traffic during Zscaler Client Connector authentication. Improves the Learn More link for new error codes reported by Zscaler Client Connector. Allows users to reauthenticate Zscaler Private Access (ZPA) before their authentication expires.

* Fixes an issue where the zsa:// shortcut that opens Zscaler Client Connector didn’t work. * Fixes an issue where users experienced intermittent ZPA authentication errors after Tunnel SDK 3.8 was enabled.

Fixes an issue where, for some iOS devices, the ZIA Enabled service status displayed a False value, indicating that ZIA service is not entitled even though it was entitled.

* Includes support for Zscaler Digital Experience (ZDX) on iOS devices. * Supports per app VPN access for Zscaler Private Access (ZPA) apps along with Enterprise VPN for Zscaler Internet Access (ZIA) on iOS devices. * Zscaler Client Connector now supports enrollment for ZIA-only and ZIA + ZPA users without any user input when Zscaler Client Connector Portal is used as an identity provider (IdP) for authentication. * Provides Disaster Recovery options when ZIA or ZPA are not reachable. * Includes support for wildcard (*) ZPA application segments. * Adds External Device ID value in Device Details. * Fixes an issue where the VPN connection icon showed on the device even when the user wasn’t logged in to Zscaler Client Connector. * Prevents users from being able to reauthenticate ZPA using a different username during enrollment. * Fixes an issue where the user experienced a network error intermittently after clicking Login when authenticating with Zscaler Client Connector. * Fixes an issue where some traffic didn’t pass through Zscaler Client Connector intermittently when switching the network from Wi-Fi to cellular. * Fixes a network connection issue that occurred when accessing websites or applications immediately after a network change because of a connection reset due to a routing change.

* Fixes an issue where sometimes Zscaler Private Access (ZPA) resources weren’t accessible after a network switch when the SystemDNSEnabled flag was enabled. * Fixes an issue where users couldn't successfully connect to a hotspot from an iOS device running Z-Tunnel 3.7 SDK.

* Fixes an issue where the Ownership device posture failed intermittently on Tunnel 1.9 SDK. * Fixes an issue where Zscaler VPN wasn’t enabled automatically when a device had multiple VPNs and when a user switched between those VPN profiles. * Fixes an issue where the search domain order was incorrect for Tunnel 3.7 SDK on Per App VPNs while using PAVConnectionSynced flag.

* Fixes an issue where after upgrading to Zscaler Client Connector version 3.7 for iOS, the customers experienced random device posture failures for the Ownership Variable on tunnel SDK 1.9.

* Includes native IPv6 support. * Allows ZCC to switch between different Tunnel sdk versions e.g. 1.9.12 , 3.7 . Admins can see the active tunnel SDK version to track the devices switching between multiple tunnel SDK versions. * Provides support to include IPv6 modes configuration through the Zscaler Client Connector Portal. To learn more, see Configuring Zscaler Client Connector Profiles. * Adds support for Zscaler Client Connector to tunnel internal traffic through Zscaler. To learn more, see Configuring Zscaler Client Connector Profiles. * Includes support of tunnel internal traffic in the tunnel mode and Tunnel with Local Proxy (TWLP) mode. * Zscaler Client Connector binds to the loopback address to intercept the loopback traffic in the Tunnel with Local Proxy mode. * Includes support for segmented HTTP requests in Z-Tunnel 1.0. * Adds support for posture-based risk profiles for ZIA. To learn more, see About Device Posture Profiles. * Provides support for the current health and enabled status of Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) in the Zscaler Client Connector Portal. * Provides a password to disable the ZPA service, as configured in the Zscaler Client Connector Portal. * Adds a security update to the libcrypto module. * Includes the requirement for admins to specify the username and userDomain parameters together when deploying Zscaler Client Connector via an MDM. To learn more, see Deploying Zscaler Client Connector with Microsoft Intune for iOS. * Provides the ability to set different passwords for disabling Zscaler services. To learn more, see Configuring Zscaler Client Connector Profiles. * Improves how error messages are displayed in Zscaler Client Connector for end users. * Zscaler Client Connector displays a new error message 3102 for devices that are in a quarantine state. * Includes the option to configure ZPA reauthentication notifications under the Zscaler Client Connector Notification Settings tab. End users can override this setting by configuring notifications in the More Window of Zscaler Client Connector. To learn more, see Configuring End User Notifications for Zscaler Client Connector. * Provides a more descriptive subject line for emails that Zscaler receives when users complete the Report an Issue form. * Acknowledges Zscaler's use of third-party software in the License and Credits section of the More window in Zscaler Client Connector. To learn more, see Viewing Information About Zscaler Client Connector. * Displays the tunnel version for ZIA in Zscaler Client Connector. * Displays the broker to which the Zscaler Client Connector is connected for the ZPA service. * Fixes an issue where, for some iOS users, access to applications failed on an IPv6-only network. * Fixes a captive portal error issue experienced on iOS devices in China. * Fixes an issue where the Zscaler Client Connector log files were missing tunnel logs when the logs were obtained through the remote fetch logs option. * Fixes an issue where Zscaler Client Connector showed a Captive Portal Detected status when the device network changed, or when Zscaler Client Connector restarted while the iOS app BuddyCom was running. * Fixes an issue where Zscaler Client Connector displayed an error message instead of a scheduled maintenance message.

* Fixes an issue where iPhone users couldn’t join Google Meet when connected to the Zscaler Private Access (ZPA) service. * Fixes a caching issue when signing into Zscaler Client Connector on shared devices.

* Fixes a DNS response issue that caused a delay in opening web pages and applications on certain cellular carriers. * Fixes an intermittent traffic forwarding issue when ZIA was turned on automatically after turning off. * Fixes an issue where customers using Zscaler Client Connector couldn’t access the internet intermittently on switching networks. * Fixes an issue where iOS devices using per-app VPN experienced a page load failure error on the initial launch of VPN.

* Fixes an issue where dns resolution failed intermittently for per app vpn applications

* Fixes an issue where iOS devices using per-app VPN experienced a page load failure error. * Adds a security update to the libcrypto module. * Fixes an issue where iOS users couldn’t log into Zscaler Client Connector due to Error 68.