EUVD-2026-36522
GHSA-xm5c-4gf9-qf8c
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V4 - API and Web Service Improper authorization in handler
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 26, 2026
Privilege escalation in the Zoom Workplace mobile app (Android before 7.0.4, iOS before 7.0.3) stems from improper authorization in the handler that processes the app's custom URL scheme, allowing an unauthenticated actor to elevate privileges via network access. Zoom self-reported and patched the flaw, and no public exploit identified at time of analysis; EPSS remains very low (0.04%, 12th percentile) and CISA SSVC marks exploitation as none, indicating no observed activity despite the 9.8 CVSS score.
Earlier versions of this analysis (2)
Privilege escalation in Zoom Workplace mobile clients (before 7.0.4 on Android and 7.0.3 on iOS) stems from an improperly authorized custom URL scheme handler, letting an unauthenticated remote actor invoke privileged in-app actions through crafted scheme links. The vendor-assigned CVSS of 9.8 reflects full confidentiality, integrity, and availability impact, though EPSS is very low (0.04%, 12th percentile) and there is no public exploit identified at time of analysis. CISA SSVC marks exploitation as none and not automatable, indicating no observed in-the-wild activity despite the critical rating.
Privilege escalation in Zoom Workplace mobile apps (Android before 7.0.4, iOS before 7.0.3) stems from improper authorization in the custom URL scheme handler, allowing a remote attacker to escalate privileges over the network with high confidentiality and integrity impact. No public exploit identified at time of analysis, and the issue was self-reported by Zoom in security bulletin ZSB-26010. EPSS and KEV data were not provided, but the absence from CISA KEV combined with vendor self-disclosure suggests no known active exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Zoom Workplace gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Custom URL scheme handlers are reached by the victim opening an attacker-supplied link or co-resident app, so UI:R is more honest than the vendor's UI:N; impact remains total.
Primary rating from Vendor (Zoom).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access.
Executive ViewAI
Zoom Workplace mobile app contains a critical privilege escalation vulnerability (CVSS 9.8) that could allow attackers to compromise mobile devices integral to workforce communications and authentication. Zoom has released patches (Android 7.0.4, iOS 7.0.3), and while no active exploitation has been observed to date, the vulnerability's severity and the ubiquity of mobile Zoom usage necessitate rapid organizational patching.
Within 24 hours: Send mandatory security update notification to all mobile device users requiring Zoom Workplace update to version 7.0.4 (Android) or 7.0.3+ (iOS). Within 7 days: Deploy MDM policies enforcing these minimum versions and verify ≥95% compliance across managed endpoints. Within 30 days: Conduct inventory audit of all Zoom Workplace installations and implement automatic version enforcement to prevent rollback to vulnerable releases.
Apply vendor patch (Android 7.0.4, iOS 7.0.3). If immediate patching is infeasible, restrict mobile Zoom Workplace access to corporate VPN only and implement network monitoring for privilege escalation indicators; these interim controls reduce risk but do not eliminate the vulnerability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Zoom Workplace
View allPrivilege escalation in Zoom Workplace mobile clients (Android before 7.0.4, iOS before 7.0.3) stems from improper autho
Privilege escalation in the custom URL scheme handler of Zoom Workplace for Android before version 7.2.1 allows an attac
Zoom Workplace clients with the Zoom Phone feature contain a network-reachable buffer overflow (CWE-120) that can lead t
Information disclosure in Zoom Workplace for iOS before version 7.0.0 allows an authenticated user with physical access
Exploit-DB