What is the CVSS score of CVE-2026-53411?

CVE-2026-53411 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Zoom Workplace VDI Plugin are affected by CVE-2026-53411?

Zoom Workplace VDI Plugin for Windows versions prior to 6.6.14 contain a privilege escalation vulnerability exploitable by authenticated local users.. A patch is available.

How to fix or mitigate CVE-2026-53411?

Within 24 hours, identify all Windows VDI systems running Zoom Workplace VDI Plugin and document their current versions. Within 7 days, test Zoom Workplace VDI Plugin version 6.6.14 or later in non-production VDI environments to validate compatibility with existing deployments. Within 30 days, deploy the patched version to all production VDI systems using your standard change management process.

Zoom Workplace VDI Plugin CVE-2026-53411

EUVD-2026-45046 HIGH

Improper Input Validation (CWE-20)

2026-07-16 Zoom

GHSA-58pc-566f-r6jx

Privilege Escalation Microsoft Zoom Workplace Vdi Plugin Zoom Communications

7.0

CVSS 3.1 · NVD

Severity by source

Vendor (Zoom) PRIMARY

HIGH

qualitative

NVD

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local vector and high complexity reflect installer race condition; PR:L for authenticated non-admin local user; full C/I/A impact upon SYSTEM escalation; no scope change as compromise is confined to the single host.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Zoom).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 12, 2026 - 00:14 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 12, 2026 - 00:07 vuln.today

cvss_changed

CVSS changed

Aug 12, 2026 - 00:07 NVD

7.8 (HIGH) 7.0 (HIGH)

Patch available

Jul 16, 2026 - 23:03 EUVD

Analysis Generated

Jul 16, 2026 - 22:00 vuln.today

CVE Published

Jul 16, 2026 - 21:13 cve.org

HIGH 7.8

DescriptionNVD

A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges.

AnalysisAI

Privilege escalation in Zoom Workplace VDI Plugin for Windows (all versions prior to 6.6.14) is achievable by an authenticated local user exploiting a TOCTOU race condition during the product's installation or uninstallation process. The attack targets the narrow window between the installer's security check and its subsequent resource use, allowing a local attacker to substitute a controlled file or symlink and have it processed under elevated installer privileges. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.14% at the 4th percentile signals very low real-world exploitation probability, though SSVC rates the technical impact as total if the race is won.

Technical ContextAI

The affected component is Zoom Workplace VDI Plugin for Windows, identified by CPE cpe:2.3:a:zoom_communications:zoom_workplace_vdi_plugin:*:*:*:*:*:*:*:*, specifically all releases before 6.6.14. VDI (Virtual Desktop Infrastructure) plugins routinely require elevated or SYSTEM-level privileges during install and uninstall operations on Windows, making their installer processes attractive targets. A TOCTOU race condition - more precisely CWE-367 than the assigned CWE-20 (Improper Input Validation), which appears to be a broader NVD categorization - occurs when a resource (file, directory, or symlink) is validated at one point in time but then accessed or modified under elevated context moments later without re-verification. An attacker who can manipulate the filesystem path in that intervening window can redirect the privileged operation to an attacker-controlled resource, achieving code execution or file writes under SYSTEM context.

RemediationAI

The primary remediation is upgrading Zoom Workplace VDI Plugin to version 6.6.14 or later, as released and confirmed by Zoom in security bulletin ZSB-26013 at https://www.zoom.com/en/trust/security-bulletin/zsb-26013. If immediate upgrade is not possible, restrict local interactive access to endpoints running affected VDI Plugin versions, particularly preventing lower-privileged users from executing or interfering with filesystem paths used during Zoom installer operations. Enforcing application control policies (e.g., Windows Defender Application Control or AppLocker) to restrict write access to Zoom installation directories during install or uninstall events reduces the exploitable window, though this requires careful tuning to avoid breaking legitimate installer functionality. Process monitoring for unusual symlink creation or file substitution activity in Zoom installer paths can serve as a detection control in environments where patching is delayed.