Back Heise.De

Web conferencing tool Zoom: Account takeover from the network possible

Heise.De • July 16, 2026

In the video conferencing software Zoom, the developers have patched several security vulnerabilities. One is considered a critical risk, three as high risk. Users and administrators should ensure they have updated to the current versions.

Insufficient validation of user input in Zoom Desktop Client for Windows before version 7.0.0 and Zoom VDI Client for Windows before versions 7.0.10, 6.6.15, and 6.5.18 allows unauthenticated users from the internet with network access to take over accounts ( CVE-2026-53412 , CVSS 9.8 , Risk “ critical ”). Zoom does not provide deeper details. The manufacturer also does not list temporary countermeasures.

Furthermore, local authenticated attackers can escalate their privileges due to insufficient input validation in Zoom Workplace VDI Plugin for Windows before version 6.6.14 ( CVE-2026-53411 , CVSS 7.8 , Risk “ high ”). Authenticated users can also achieve this due to insufficient privilege management in Zoom Rooms for Windows before 7.1.0 ( CVE-2026-53409 , CVSS 7.8 , Risk “ high ”). During installation or uninstallation processes of certain Zoom clients on Windows, authenticated users can escalate their privileges in the system because a race condition (time-of-check to time-of-use, TOCTOU) can occur ( CVE-2026-53410 , CVSS 7.0 , Risk “ high ”). Affected versions include Zoom Workplace for Windows before 7.0.5, Zoom Workplace VDI Client for Windows before 6.5.17 and 6.6.14, Zoom Workplace VDI plugin for Windows before 6.5.17 and 6.6.14, Zoom Rooms for Windows before 7.0.5, and Remote Control for Zoom Center for Windows before version 7.0.0.

The updated software is available for download in the Zoom download portal . Since the Windows software is particularly impacted, calling the command prompt and the command winget upgrade --all also usually helps, which updates not only the Zoom software but also various other installed software if necessary.

Most recently, Zoom dealt with critical vulnerabilities in its video conferencing software around mid-March. Among other things, they allowed attackers from the network to escalate their privileges.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Zoom Vulnerability Allows Unauthenticated Account Takeover Zoom has patched a critical vulnerability (CVE-2026-53412) in its Windows desktop client and VDI software that could allow unauthenticated attackers to take over user accounts via network access. The flaw, rated 9.8 out of 10 on the CVSS scale, stems from improper input validation and affects multiple versions of Zoom Workplace and the VDI Client for Windows. Users are urged to update immediately to mitigate potential exploitation, as the vulnerability could lead to unauthorized access to sensitive meetings and data. No evidence of active exploitation has been reported, but the nature of the vulnerability poses significant risks to enterprises using Zoom for collaboration. Additional vulnerabilities were also patched in this update, including privilege escalation issues. The security advisory emphasizes the urgency for organizations to apply the latest updates without delay. 16 sources 73

Extracted Entities

Web conferencing tool Zoom: Account takeover from the network possible

The full story

Extracted Entities

CVEs (4)

CWE Weaknesses (3)

Domains (1)

Platforms (2)