Zoom Clients CVE-2026-108184

Exploitation requires the attacker to hold a man-in-the-middle position on the network path between the Windows Zoom client and its server so that a forged/invalid TLS certificate can be injected; the improper certificate validation (CWE-295) then causes the client to accept that certificate and expose data in transit. This MITM prerequisite is exactly why the vector is rated AC:H - it is not achievable by a remote attacker with no network control. Limiting factors: attacker must be able to intercept TLS traffic (e.g., hostile Wi-Fi, ARP/DNS spoofing, or a compromised network device), and the issue is specific to affected versions of Zoom Clients for Windows. No authentication is required (PR:N) and no user interaction is needed (UI:N) once the interception position is held.

The CVSS base score of 7.4 (High) is driven by network attack vector (AV:N), no privileges (PR:N), no user interaction (PR:N/UI:N) and high confidentiality and integrity impact (C:H/I:H), but it is materially tempered by high attack complexity (AC:H). For a CWE-295 improper-certificate-validation flaw, AC:H almost always reflects the need for a privileged man-in-the-middle position on the network path, which is a meaningful real-world barrier. No EPSS probability was supplied in the input, so exploitation likelihood cannot be quantified; this absence should not be read as 'low,' only as unmeasured. The CVE is not listed in CISA KEV and no proof-of-concept is referenced, so this is 'no public exploit identified at time of analysis.' Net assessment: this is a genuine but conditional confidentiality risk rather than a drop-everything emergency - the high CVSS reflects impact and network reachability, while the practical bar (TLS interception / MITM) keeps real-world risk moderate and opportunistic rather than mass-exploitable. One conflict to verify with the vendor: the prose description states only 'information disclosure,' yet the CVSS vector asserts I:H (high integrity impact); the integrity claim is not substantiated by the description text and should be confirmed against Zoom bulletin ZSB-26021.

An attacker positioned on the network path between a Windows Zoom client and Zoom's servers (e.g., on a shared/public Wi-Fi network or a compromised router) presents a fraudulent TLS certificate that the client fails to properly validate. Because the client accepts the invalid certificate, the attacker can intercept and read sensitive data in transit. No proof-of-concept is referenced in the available intelligence, and the AC:H rating reflects the need to first achieve this interception position.