EUVD-2026-36523
GHSA-589r-wg5p-vwjq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify victim on vulnerable Zoom mobile build
-
DeliveryCraft malicious custom-scheme URL
-
ExploitDeliver via phishing link or rogue app
-
ExecutionHandler processes URL without authorization check
-
PersistPrivileged in-app action executes
-
ImpactEscalated access to Zoom account data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V4 - API and Web Service Improper authorization in handler
|
| Exploitation Conditions | Exploitation requires that a vulnerable Zoom Workplace build is installed (Android <7.0.4 or iOS <7.0.3) and that the attacker can cause a crafted URL using Zoom's registered custom URL scheme to be processed by the app's handler - typically by getting the victim to open a malicious link in a browser, message, or another app, or by having any app on the device emit the corresponding intent/URL. The CVSS PR:L indicates the attacker (or invoking context) needs some low-level privilege such as an existing authenticated Zoom session or another installed app capable of dispatching the URL, while UI:N means no explicit user click on an in-app prompt is required once the handler is reached; exploitation is limited to users on the listed pre-patch versions and is constrained by mobile OS sandboxing, so impact stays within the Zoom app's data and account context rather than the whole device. |
| Impact | The CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N indicates network-reachable, low-complexity exploitation against an already-authenticated mobile user with high confidentiality and integrity impact, which is meaningful for a widely-deployed collaboration client. There is some tension in the signals: PR:L implies the attacker (or another app/context) already has some low-level privilege, while UI:N and AV:N suggest no victim interaction is needed - consistent with a malicious link or cross-app message reaching the handler in the background. EPSS is not provided, KEV status is not listed, and no POC is referenced, so this is best treated as a vendor-disclosed high-severity issue worth prompt patching on managed mobile fleets rather than an emergency in-the-wild scenario; verify with Zoom's bulletin whether 'network access' truly means remote-only or also covers same-device cross-app invocation, since CWE-939 typically applies to the latter. |
| Exploit ScenarioDerived | An attacker crafts a malicious zoommtg:// (or related custom-scheme) URL and delivers it via phishing email, chat message, or a web page that the victim opens on a mobile device running a vulnerable Zoom Workplace build. The handler processes the URL without proper authorization checks, causing the app to perform a privileged action on behalf of the attacker and elevating their effective privileges within the Zoom context; no public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 12, 2026
Privilege escalation in Zoom Workplace mobile clients (Android before 7.0.4, iOS before 7.0.3) stems from improper authorization in the handler for a custom URL scheme, allowing a remote attacker to elevate privileges over network access. The CVSS 8.1 rating reflects high confidentiality and integrity impact with low-complexity exploitation, though no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
RemediationAI
Vendor-released patch: upgrade Zoom Workplace to 7.0.4 or later on Android and 7.0.3 or later on iOS per Zoom Security Bulletin ZSB-26010 (https://www.zoom.com/en/trust/security-bulletin/zsb-26010), pushed via MDM where possible to enforce minimum versions. Where immediate patching is not feasible, compensating controls include using MDM/MAM policies to block installation of untrusted third-party apps that could invoke the Zoom URL scheme, instructing users not to click zoommtg:// or related Zoom deep links from untrusted email, chat, or web sources, and on managed Android devices restricting which apps can send implicit intents to Zoom; note these controls degrade legitimate deep-link workflows such as one-tap meeting joins from calendar invites and SSO portals.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Zoom Workplace is Zoom Communications' unified mobile collaboration client for Android and iOS that registers custom URL schemes (e.g., zoommtg://) so other apps and web pages can launch Zoom functionality with parameters. The root cause is CWE-939 (Improper Authorization in Handler for Custom URL Scheme), where the deep-link/intent handler accepts URL-borne actions without sufficiently validating the caller's authorization context, so a network-delivered URL can invoke privileged in-app actions intended for trusted callers. On Android the entry point is typically an exported Activity bound to an intent-filter scheme, and on iOS it is a registered URL type routed through the application's URL handler.
Know when Zoom Workplace gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable custom URL handler, low complexity, requires an existing low-privilege Zoom session context (PR:L), no user interaction, high C/I impact on the user's Zoom data with no availability effect.
Primary rating from Vendor (Zoom).
CVSS VectorVendor: Zoom
Lifecycle Timeline
2DescriptionCVE.org
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access.
Executive ViewAI
Zoom Workplace mobile clients contain a privilege escalation vulnerability (CVSS 8.1) in custom URL scheme authorization that could allow remote attackers to elevate access on user devices. The vulnerability affects Android and iOS deployments; no public exploit has been identified, but the absence of a vendor patch means immediate interim controls are required to protect any organization relying on Zoom for mobile communications.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict Zoom Workplace mobile client usage to fully-managed devices with MDM enrollment and continuous monitoring; implement network segmentation to limit lateral movement from mobile devices; enforce multi-factor authentication on all Zoom accounts; disable or restrict URL scheme integrations in Zoom client settings; monitor authentication and system logs for privilege escalation activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Zoom Workplace
View allPrivilege escalation in the Zoom Workplace mobile app (Android before 7.0.4, iOS before 7.0.3) stems from improper autho
Privilege escalation in the custom URL scheme handler of Zoom Workplace for Android before version 7.2.1 allows an attac
Zoom Workplace clients with the Zoom Phone feature contain a network-reachable buffer overflow (CWE-120) that can lead t
Information disclosure in Zoom Workplace for iOS before version 7.0.0 allows an authenticated user with physical access
Exploit-DB