What is the CVSS score of CVE-2026-53412?

CVE-2026-53412 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Zoom Workplace are affected by CVE-2026-53412?

Zoom's Windows client family (Desktop Client, VDI Client, and Meeting SDK for Windows) is vulnerable to an unauthenticated remote account takeover (CVE-2026-53412, CVSS 9.8) that allows attackers to…. A patch is available.

How to fix or mitigate CVE-2026-53412?

Within 24 hours, identify all Windows Zoom users in your organization and alert them to monitor for unauthorized account access or suspicious meeting activity, then enable detailed logging on all Zoom accounts to capture potential compromise attempts. Within 7 days, implement network-level controls to restrict Zoom communications to corporate VPN/firewall-managed pathways only, consider temporarily disabling Zoom on non-essential systems, and set up real-time alerts for anomalous account activity such as logins from new locations or devices. Within 30 days, monitor Zoom's security bulletins for ZSB-26014 patch availability; establish a rapid deployment procedure for immediate rollout when the vendor releases a fix, and reassess whether usage restrictions should remain in place based on patch availability and timeline.

Zoom Workplace CVE-2026-53412

EUVD-2026-45048 CRITICAL

Improper Input Validation (CWE-20)

2026-07-16 Zoom

GHSA-xq34-4qgv-ggmc

Information Disclosure Microsoft Zoom Workplace For Windows Zoom Communications

9.8

CVSS 3.1 · Vendor: Zoom

Severity by source

Vendor (Zoom) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated remote low-complexity account takeover gives C:H/I:H and PR:N/UI:N; A set to N since account takeover impacts confidentiality and integrity, not availability as described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Zoom).

CVSS VectorVendor: Zoom

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 16, 2026 - 23:03 EUVD

Analysis Generated

Jul 16, 2026 - 22:00 vuln.today

CVE Published

Jul 16, 2026 - 21:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network access.

AnalysisAI

Account takeover in Zoom's Windows client family - the Zoom Desktop Client, Zoom VDI Client, and Zoom Meeting SDK for Windows - lets a remote, unauthenticated attacker seize control of a victim's account by sending crafted input over the network, per Zoom's security bulletin ZSB-26014. The flaw stems from improper input validation (CWE-20) and carries a vendor CVSS of 9.8, reflecting full confidentiality, integrity, and availability impact with no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch.

Technical ContextAI

The vulnerability lives in Zoom's Windows-based clients built on the Zoom Workplace codebase (CPE cpe:2.3:a:zoom_communications:zoom_workplace_for_windows). CWE-20 (Improper Input Validation) means the client accepts data from a network peer or service without adequately verifying its structure, type, or bounds before acting on it. In a real-time communications client this class of flaw typically arises in the parsing of meeting/signaling messages or SDK-handled payloads, where malformed input is trusted and used to influence authentication or session state - here severe enough that it culminates in account takeover rather than a mere crash or disclosure. The shared codebase across the Desktop Client, VDI Client, and Meeting SDK explains why all three Windows products are affected simultaneously.

RemediationAI

Apply the update referenced in Zoom's advisory - Patch available per vendor advisory (ZSB-26014, https://www.zoom.com/en/trust/security-bulletin/zsb-26014); the input data does not include an exact fixed version number, so consult the bulletin for the specific patched build and upgrade the Zoom Desktop Client, VDI Client, and Meeting SDK for Windows to it. Because Zoom clients auto-update, ensure automatic updates are enabled and force a client refresh across managed endpoints via your MDM/software-distribution tooling rather than relying on user-initiated updates. If immediate patching is not possible, compensating controls are limited for a client-side network-triggered flaw: restrict which networks/peers can reach clients where feasible, prioritize updating internet-facing or SDK-embedded deployments first, and for the Meeting SDK rebuild and redistribute applications against the fixed SDK version, since embedded SDK copies will not auto-update with the desktop client.