Zscaler (ZS) Plunges 8.32% as Cybersecurity Incident Sparks Investor Skepticism

The share price fell to its lowest level since April 2025 today, with an intraday decline of 8.32%.

Zscaler (ZS) reported a significant drop in its stock after disclosing a high-profile cybersecurity incident involving a sophisticated attack campaign dubbed Operation Neusploit. The threat, attributed to APT28—a Russian state-sponsored group—exploited a critical vulnerability in Microsoft Office and 365 (CVE-2026-21509) to target users in Ukraine, Slovakia, and Romania. Zscaler’s ThreatLabz team identified the flaw and publicly disclosed it on January 29, 2026, three days after Microsoft released an emergency patch. The attack employed advanced techniques, including steganography and cloud-based obfuscation, to evade detection and exfiltrate sensitive data.

The incident has raised concerns about Zscaler’s ability to mitigate emerging threats despite its proactive disclosure. While the company’s rapid detection of the vulnerability and detailed analysis could reinforce its reputation as a leader in threat intelligence, the timing of the attack—occurring just days after a patch—has heightened scrutiny. Analysts note that the geopolitical context, with APT28’s history of targeting Eastern Europe, may drive demand for Zscaler’s enterprise solutions. However, the immediate market reaction reflects investor skepticism about the company’s capacity to prevent exploitation of known flaws.

Long-term, Zscaler’s role in identifying zero-day vulnerabilities could position it for growth, but near-term volatility remains tied to its perceived effectiveness in real-world threat scenarios.