Critical Zoom Workplace Flaw Lets Unauthenticated Attackers Take Over Accounts Remotely

Zoom has disclosed a critical vulnerability in its Windows desktop software that could allow unauthenticated attackers to take over user accounts remotely.

This issue, tracked as CVE-2026-53412 and addressed in bulletin ZSB-26014, arises from improper input validation in Zoom Workplace for Windows and the Zoom Workplace VDI Client for Windows.

The vulnerability has a CVSS score of 9.8 out of 10, indicating its severe risk due to its network-reachable nature, lack of authentication requirements, and potential for complete compromise of confidentiality, integrity, and availability.

The CVSS vector for the vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates that an attacker can exploit the flaw over a network with low complexity, meaning they do not need an existing Zoom account, valid credentials, local access, or interaction from the intended victim.

If exploited, this vulnerability may lead to an account takeover, allowing a threat actor to impersonate the affected user and potentially access meetings, communications, shared content, and account-linked resources.

Zoom described the issue as an improper input validation vulnerability, which occurs when software fails to verify or sanitize data received from external sources adequately.

While the advisory does not provide technical details on exploitation, such flaws can enable attackers to manipulate application behavior by sending specially crafted network input.

Since the vulnerable components operate in a collaborative environment commonly used for corporate communications, remote meetings, and sensitive file sharing, account compromise could create significant downstream risks for organizations.

The affected versions include Zoom Workplace for Windows releases before version 7.0.7 and the Zoom Workplace VDI Client for Windows in multiple supported release branches: versions earlier than 7.0.107, 6.6.156, and 6.5.186.

Organizations using virtual desktop infrastructure should prioritize patching their VDI deployments, as centrally managed environments can expose numerous users to the same vulnerability if clients remain unpatched.

Zoom Offensive Security reported this vulnerability and it was initially published on July 14, 2026. A revision was issued on July 15, 2026, removing the Zoom Meeting SDK for Windows from the affected product list.

This clarification is important for development and security teams, as it specifies that the identified exposure is limited to the Windows Workplace desktop and VDI clients, rather than applications built with the Windows Meeting SDK.

Administrators are advised to immediately inventory installed versions of Zoom Workplace and the VDI Client, deploy the latest updates from Zoom’s official download portal, and ensure that endpoint management policies prevent the continued use of affected legacy releases.

Security teams should also monitor for unusual account activity, unexpected meeting changes, unfamiliar login sessions, and anomalous file-sharing behavior as potential signs of abuse.

Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now .

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Dutch police, working with international law-enforcement partners including Europol, have disrupted a sprawling investment-fraud operation…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are actively exploiting…

A macOS-focused information stealer is combining stolen wallet databases with credentials harvested from the Apple…

Splunk has released security updates for three vulnerabilities in Splunk Enterprise and Splunk Cloud Platform.…

JetBrains has released security updates for IntelliJ IDEA, TeamCity, and YouTrack that address six vulnerabilities,…

AI agents are increasingly crossing the line from generating content to executing actions inside developer…