This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Zoom fixes 4 vulnerabilities

Zoom fixes 4 vulnerabilities in its products, one of them critical [1][2][3][4]. Products and their fixed versions: Zoom Workplace for Windows – 7.0.5 [1][2] Zoom Workplace VDI Client for Windows – 7.0.10, 6.6.15, 6.5.18 [1][2] Zoom Workplace VDI Plugin for Windows – 6.6.14, 6.5.17 [2][4] Zoom Rooms for Windows – 7.1.0 [2][3] Remote Control for Zoom Contact Center for Windows – 7.0.0 [2]

Zoom Workplace / VDI Client for Windows - account takeover (CVE-2026-53412)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can take over a user account in Zoom Workplace for Windows and Zoom Workplace VDI Client for Windows due to improper input validation [1].

The vulnerability is present in products:

  • Zoom Workplace for Windows; <7.0.0
  • Zoom Workplace VDI Client for Windows; <7.0.10; <6.6.15; <6.5.18

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 14. 7. 2026.

Zoom Clients for Windows - privilege escalation (CVE-2026-53410)
CVSS 7.0 (High)

An authenticated local attacker can elevate their privileges in Zoom Clients for Windows due to a time-of-check to time-of-use race condition in the installation and uninstallation process [2].

The vulnerability is present in products:

  • Zoom Workplace for Windows; <7.0.5
  • Zoom Workplace VDI Client for Windows; <6.6.14; <6.5.17
  • Zoom Workplace VDI Plugin for Windows; <6.6.14; <6.5.17
  • Zoom Rooms for Windows; <7.0.5
  • Remote Control for Zoom Contact Center for Windows; <7.0.0

CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 14. 7. 2026.

Zoom Rooms for Windows - privilege escalation (CVE-2026-53409)
CVSS 7.8 (High)

An authenticated local attacker can escalate their privileges in Zoom Rooms for Windows due to improper permission management [3].

The vulnerability is present in product:

  • Zoom Rooms for Windows; <7.1.0

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 14. 7. 2026.

Zoom Workplace VDI Plugin for Windows - privilege escalation (CVE-2026-53411)
CVSS 7.8 (High)

An authenticated local attacker can escalate their privileges in Zoom Workplace VDI Plugin for Windows due to improper input validation [4].

The vulnerability is present in product:

  • Zoom Workplace VDI Plugin for Windows; <6.6.14

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 14. 7. 2026.

By CESNET, z.s.p.o. Henrieta Paločková on 17. 7. 2026.

CESNET, z.s.p.o. Logo