What is the CVSS score of CVE-2026-53410?

CVE-2026-53410 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Zoom Client are affected by CVE-2026-53410?

A privilege escalation vulnerability in Zoom Client for Windows (CVE-2026-53410) allows authenticated local users to gain SYSTEM-level access, creating direct risk for credential compromise and…

How to fix or mitigate CVE-2026-53410?

Within 24 hours, inventory all Zoom Client for Windows deployments and versions across your environment, and audit physical and logical access controls for systems running Zoom to identify shared-access or publicly-accessible endpoints. Within 7 days, implement compensating controls by disabling user-initiated uninstallation via Group Policy (gpedit.msc: User Configuration > Administrative Templates > Windows Components > Windows Installer > Disable Windows Installer) or MDM, restricting local administrative privilege grants, and enabling Windows Security Log monitoring for privilege escalation events (Event ID 4688). Within 30 days, establish a continuous monitoring process for Zoom security bulletin ZSB-26012 and vendor patch releases, document your patch deployment plan for immediate deployment upon availability, and complete a risk assessment for any endpoints that cannot be restricted to single-user access.

Zoom Client CVE-2026-53410

EUVD-2026-45045 HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-07-16 security@zoom.us

GHSA-vgcc-2r5p-6qvc

Privilege Escalation Zoom Microsoft Workplace Desktop Rooms Workplace Virtual Desktop Infrastructure Remote Control For Zoom Contact Center

7.0

CVSS 3.1 · Vendor: zoom

Severity by source

Vendor (zoom) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local authenticated user (AV:L/PR:L) must win a timing-sensitive race (AC:H); winning yields SYSTEM-level EoP, so C:H/I:H/A:H with unchanged scope.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zoom).

CVSS VectorVendor: zoom

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 21:32 vuln.today

CVE Published

Jul 16, 2026 - 21:17 cve.org

HIGH 7.0

DescriptionCVE.org

A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges.

AnalysisAI

Local privilege escalation in certain Zoom Clients for Windows lets an authenticated local user exploit a time-of-check to time-of-use (TOCTOU) race during install/uninstall to gain higher privileges (likely SYSTEM). The flaw was reported by Zoom's own security team and is documented in bulletin ZSB-26012; no public exploit identified at time of analysis and it is not on CISA KEV. The high-complexity race window and local-access requirement temper an otherwise high-impact (C:H/I:H/A:H) issue.

Technical ContextAI

The root cause is CWE-367 (Time-of-check Time-of-use race condition): the Windows installer/uninstaller validates a resource (e.g., a file path, permission, or link target) at one moment and then acts on it at a later moment, allowing an unprivileged local process to swap or redirect that resource in the interval. Because Windows installer and uninstaller flows for Zoom run with elevated privileges (typically as SYSTEM via the Windows Installer service or an elevated setup binary), winning the race lets attacker-controlled content be operated on by a privileged process - a classic elevation-of-privilege primitive on Windows involving file operations, junctions/symlinks, or DLL/path handling during MSI custom actions. Exact affected build ranges are not enumerated in the provided data (no CPE strings supplied); the vendor scopes it to 'certain Zoom Clients for Windows.'

RemediationAI

Update to the fixed Zoom Client for Windows release identified in Zoom Security Bulletin ZSB-26012 (https://www.zoom.com/en/trust/security-bulletin/zsb-26012); the exact fixed version is not present in the provided data, so confirm it directly from that advisory before deploying - Patch available per vendor advisory. As compensating controls until patched: restrict who can run install/uninstall operations by removing local administrator rights and enforcing least privilege so untrusted users cannot stage race conditions; centralize Zoom deployment/updates through managed software distribution (SCCM/Intune) rather than allowing per-user installs, which reduces the window in which an interactive user can interfere with installer file operations; and monitor for suspicious file/junction manipulation in temp and installer directories during Zoom setup. Trade-off: locking down local admin and install rights may disrupt users who self-manage Zoom updates, so pair it with a managed auto-update path.