Loading story…
Zoom has released fixes for a critical Windows vulnerability, CVE-2026-53412, that could let an unauthenticated attacker take over user accounts over the network. The flaw, caused by improper input validation and rated CVSS 9.8, affects older versions of Zoom Workplace for Windows and the Zoom VDI Client for Windows; some reports also said the Meeting SDK for Windows was impacted, while a later advisory revision clarified the SDK was not affected. Zoom credited its Offensive Security team with finding the issue and urged customers to quickly identify vulnerable installations and apply patched versions.
The company also fixed three high-severity local privilege escalation bugs—CVE-2026-53409, CVE-2026-53410, and CVE-2026-53411—across multiple Windows components, including Workplace, VDI, Zoom Rooms, and Contact Center-related software. Zoom said it had no evidence of in-the-wild exploitation at the time of disclosure, but advised organizations to update immediately and monitor for suspicious account or session activity following remediation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Alongside CVE-2026-53412, Zoom patched CVE-2026-53410, CVE-2026-53409, and CVE-2026-53411, three high-severity Windows vulnerabilities that could enable local authenticated privilege escalation. The issues affected various Zoom Workplace, VDI, Zoom Rooms, and Contact Center components depending on the product branch.
Zoom revised Security Bulletin ZSB-26014 and continued warning users to update immediately for CVE-2026-53412. Across the disclosures, Zoom said its Offensive Security team discovered the flaw and that it had no indication of in-the-wild exploitation.
Zoom published Security Bulletin ZSB-26014 disclosing CVE-2026-53412, a critical improper input validation vulnerability in its Windows products that could allow unauthenticated account takeover via network access. The advisory also accompanied security updates for affected Zoom Workplace and VDI Client versions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcecsoonline.com
Open sourcebleepingcomputer.com
Open sourcezoom.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zoom released security updates to fix multiple vulnerabilities across several products, warning that successful exploitation could allow attackers to gain elevated privileges on affected systems. The most prominent issue, **CVE-2026-53407** with a **CVSS 8.1**, is an improper authorization flaw in the handler for a custom URL scheme in **Zoom Workplace Mobile Clients**. Affected products include **Zoom Workplace for Android and iOS**, **Zoom Meeting SDK for Android and iOS**, and **Remote Control for Zoom Contact Center for Windows**. Zoom provided fixed versions for the impacted software, and the advisory urges enterprises to deploy the patches as soon as internal testing is complete to reduce exposure.
Jul 8, 2026
Zoom published security advisories on March 10, 2026 addressing multiple vulnerabilities affecting Windows components, including *Zoom Workplace for Windows*, *Zoom Meeting SDK for Windows*, *Zoom Rooms for Windows*, and the *Zoom Workplace VDI Client for Windows*. The Canadian Centre for Cyber Security advisory **AV26-231** urged organizations to review Zoom’s bulletins and apply updates, noting issues spanning **external control of file name or path**, **improper privilege management**, **improper input validation**, and an **improper check** condition across the affected Windows products and versions. Reporting on the same Zoom bulletin set, one write-up highlighted four Windows-side flaws ranging from **High to Critical** severity, including a **Critical** issue in the Zoom Workplace for Windows Mail feature tracked as **CVE-2026-30903 (ZSB-26005)**, described as an *External Control of File Name or Path* weakness that could enable **unauthenticated remote privilege escalation**. The additional disclosed issues were described as **CVE-2026-30902 (ZSB-26004)** affecting Zoom Clients for Windows (*Improper Privilege Management*), **CVE-2026-30901 (ZSB-26003)** affecting Zoom Rooms for Windows (*Improper Input Validation*), and **CVE-2026-30900 (ZSB-26002)** affecting Zoom Workplace Clients for Windows (*Improper Check*), with remediation requiring upgrading to fixed releases per Zoom’s advisories.
Jun 29, 2026
Zoom disclosed and patched a **critical command-injection vulnerability** in *Zoom Node Multimedia Routers (MMRs)* that could allow **remote code execution** by a **meeting participant** over network access. The issue, tracked as **CVE-2026-22844** with a **CVSS 9.9**, affects Zoom Node MMR modules **prior to version 5.2.1716.0**; Zoom advised customers running **Zoom Node Meetings Hybrid (ZMH)** and **Zoom Node Meeting Connector (MC)** deployments to update to **5.2.1716.0 or later**. Zoom stated it has **no evidence of in-the-wild exploitation** at the time of disclosure. Separately, GitLab released fixes for multiple high-severity vulnerabilities in **GitLab CE/EE**, including issues that could enable **denial-of-service (DoS)** and a **two-factor authentication (2FA) bypass** (e.g., **CVE-2025-13927** and **CVE-2025-13928**, both CVSS 7.5, affecting broad version ranges). While reported alongside the Zoom update in one source, the GitLab items represent a distinct patch set and are not part of the Zoom MMR vulnerability event.
Jun 29, 2026