This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Zoom fixes 3 vulnerabilities
Zoom fixes 3 vulnerabilities in its products [1][2]. Products and their fixed versions: Zoom Workplace Mobile Clients - 7.0.4 (Android), 7.0.3 (iOS) [1] Remote Control for Zoom Contact Center (Windows) - 7.0.0 [2]
An unauthenticated remote attacker can elevate their privileges due to improper authorization in the handling of a custom URL scheme (Custom URL Scheme) in Zoom Workplace [1].
The vulnerability is present in products:
- Zoom Workplace (Android); <7.0.4
- Zoom Workplace (iOS); <7.0.3
- Zoom Meeting SDK (Android); <7.0.4
- Zoom Workplace SDK (iOS); <7.0.3
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
More information:
- CVE-2026-53407 at cve.org, NVD
- CVE-2026-53408 at cve.org, NVD
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 9. 6. 2026.
An authenticated local attacker can elevate their privileges due to insufficient verification of data authenticity in the remote control feature of the Zoom Contact Center application for Windows [2].
The vulnerability is present in product:
- Zoom Contact Center(Windows); <7.0.0
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-53406 at cve.org, NVD
- CWE-345: Insufficient Verification of Data Authenticity at cwe.mitre.org
The vulnerability was publicly disclosed 9. 6. 2026.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 15. 6. 2026.