CVE-2026-53412CWE-20

CVE-2026-53412

Critical · published July 17, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network access.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00529 · 44.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-07-17T02:17Z
Affected products (4)
ProductVersionsFixed in
zoom/workplace_desktop< 7.0.07.0.0
zoom/workplace_virtual_desktop_infrastructure≥ 6.5.0, < 6.5.186.5.18
zoom/workplace_virtual_desktop_infrastructure≥ 6.6.0, < 6.6.156.6.15
zoom/workplace_virtual_desktop_infrastructure≥ 7.0.0, < 7.0.107.0.10
References (1)
https://www.zoom.com/en/trust/security-bulletin/zsb-26014 · [email protected]
EPSS history
Timeline
  • 16 JUL 21:15Z
    Zoom Workplace VDI Plugin for Windows - Improper Input Validation
    cvelistv5