Zoom Workplace for Windows: Critical unauthenticated account takeover
Published: July 22, 2026
Topics on this page:
Summary
Zoom has released fixes for a critical vulnerability, tracked as CVE-2026-53412 (CVSS 9.8), affecting the Zoom Workplace desktop client for Windows, the Zoom VDI Client for Windows, and the Zoom Meeting SDK for Windows. The flaw is an improper input validation issue that may allow an attacker with network access to take over a user’s Zoom account without any authentication and without any action by the victim.
The vulnerability was discovered internally by Zoom’s Offensive Security team and disclosed on July 14, 2026, in security bulletin ZSB-26014. Zoom has not published technical details, and there are currently no reports of exploitation in the wild and no public proof-of-concept exploit. Given the severity, the wide deployment of the Zoom desktop client, and the lack of required user interaction, updating all Zoom software on Windows endpoints as soon as possible is strongly recommended. The same update also resolves three related high-severity privilege escalation vulnerabilities (CVE-2026-53411, CVE-2026-53410, and CVE-2026-53409).
Vulnerability details
CVE: CVE-2026-53412
CVSS v3.1 score: 9.8 (Critical) — Unauthenticated Account Takeover
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor bulletin: ZSB-26014
Disclosed: July 14, 2026
Discovered by: Zoom Offensive Security team (internal)
Exploit status:
As of today (July 16, 2026), there are no reports of in-the-wild exploitation and no publicly available proof-of-concept exploit code.
The vulnerability is caused by insufficient validation of input handled by the affected Zoom clients on Windows. Zoom has not released technical details, but the CVSS vector indicates the attack can be carried out remotely over the network, requires no privileges, no valid credentials, and no user interaction, and results in a full compromise of the confidentiality, integrity, and availability of the affected account. In practical terms, an attacker who can reach a vulnerable client could hijack the associated Zoom account outright.
Impact includes:
- Full account takeover by a remote, unauthenticated attacker — no phishing link, meeting invite, or other user interaction is required
- Access to account data such as chat history, contacts, cloud recordings, and calendar/meeting information
- Impersonation of the victim in meetings and chats, enabling convincing social engineering against their contacts
- Applications built on the Zoom Meeting SDK for Windows remain vulnerable until the application vendor rebuilds and re-releases against a fixed SDK version, even after the standalone Zoom client is patched.
Related vulnerabilities fixed in the same update:
Alongside CVE-2026-53412, Zoom published three additional high-severity vulnerabilities affecting its Windows products. All three are local privilege escalation issues requiring an authenticated user on the machine, so they are less urgent on their own, but an attacker who has gained a foothold on an endpoint could use them to elevate privileges. All are resolved by applying the same round of updates.
| CVE | Issues / Impact | CVSS | Affected (Windows) / Fixed in |
|---|---|---|---|
| CVE-2026-53412 | Improper input validation — unauthenticated account takeover via network access | 9.8 Critical | Workplace < 7.0.0; VDI Client < 7.0.10 / 6.6.15 / 6.5.18; Meeting SDK < 7.0.0 |
| CVE-2026-53411 | Improper input validation in the Workplace VDI Plugin — local privilege escalation by an authenticated user | 7.8 High | VDI Plugin < 6.6.14 |
| CVE-2026-53410 | TOCTOU race condition in client install/uninstall — local privilege escalation by an authenticated user | 7.0 High | Workplace < 7.0.5; VDI Client & Plugin < 6.5.17 / 6.6.14; Rooms < 7.0.5; Remote Control for Contact Center < 7.0.0 |
| CVE-2026-53409 | Improper privilege management in Zoom Rooms — local privilege escalation by an authenticated user | 7.8 High | Zoom Rooms < 7.1.0 |
Impacted versions
The following Zoom products for Windows are affected by CVE-2026-53412:
- Zoom Workplace for Windows before version 7.0.0
- Zoom Workplace VDI Client for Windows before versions 7.0.10, 6.6.15, and 6.5.18 in their respective branches
- Zoom Meeting SDK for Windows before version 7.0.0
The related vulnerabilities additionally affect Zoom Rooms for Windows (before 7.0.0 / 7.1.0), the Zoom Workplace VDI Plugin for Windows (before 6.5.17 / 6.6.14), and Remote Control for Zoom Contact Center for Windows (before 7.0.0), as summarized in the table above. macOS, Linux, and mobile clients are not listed as affected.
Recommendations
- Patch immediately: Update Zoom Workplace for Windows to version 7.0.5 or later on all Windows endpoints. Updated installers are available from the Zoom Download Center at https://zoom.us/download. Users can also update from within the client via their profile picture → Check for Updates.
- Enforce updates centrally: Where Zoom is deployed through managed tooling (Intune, SCCM, or similar), push the updated MSI to affected endpoints rather than relying on users to self-update. Zoom client updates are frequently deferred by end users when left to the in-app updater.
- Update VDI environments: For virtual desktop deployments, update the Zoom VDI Client to 7.0.10, 6.6.15, or 6.5.18 depending on the branch in use, and update the VDI Plugin to at least 6.6.14 (or 6.5.17 in the older branch). Confirm that the client and plugin versions in each pool are consistent after updating.
- Track SDK-based applications: Identify any third-party or in-house applications that embed the Zoom Meeting SDK for Windows. These remain vulnerable until the application is rebuilt against SDK 7.0.0 or later and redistributed; contact the vendor for updated releases where applicable.
- Update Zoom Rooms and Contact Center components: Update Zoom Rooms for Windows to 7.1.0 or later and Remote Control for Zoom Contact Center to 7.0.0 or later to address the related privilege escalation issues.
Mitigations
There is no vendor-provided workaround for CVE-2026-53412; updating is the only complete remediation.
Detection & verification
Am I vulnerable?
To check the installed client version, in the Zoom client select the profile picture → Settings → About, or query installed software inventory. The installed version can also be checked from PowerShell:
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* , HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object | Select-Object DisplayName, DisplayVersion
For managed fleets, endpoint management or vulnerability scanning tooling can be used to report Zoom versions across the estate and confirm remediation. There are currently no published indicators of compromise for this vulnerability; detection efforts should therefore focus on version verification and on monitoring Zoom account sign-in activity for anomalies.
References
Vendor advisory pages:
Support
As always, please let us know if you have any questions or concerns or see unusual activity on your systems that you believe might be associated with this or any other vulnerability. Please send these communications to security.response@utoronto.ca.
