Overview
- Zoom issued security updates to address CVE-2026-53412, an improper input‑validation bug that could let an unauthenticated attacker take over accounts via network access.
- The flaw affects Zoom Workplace (Windows) before 7.0.0, Zoom VDI Client for Windows before 7.0.10/6.6.15/6.5.18, and the Meeting SDK for Windows before 7.0.0.
- Zoom’s internal security team discovered the issue and assigned it a CVSS score of 9.8, indicating a critical remote vulnerability that can lead to full account compromise.
- At the time of the advisory there were no signs the flaw was being exploited in the wild, but Zoom and security outlets are urging users and administrators to apply the updates immediately because unpatched clients remain exposed.
- The patches also fix three other high‑severity Windows bugs that could allow local privilege escalation, so organizations should install all cited updates to protect desktops, VDI deployments, and SDK integrations.