Zoom Workplace CVE-2026-53412

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no authentication and no user interaction - an unauthenticated attacker with network access to a Windows Zoom Desktop Client, VDI Client, or an application built on the Zoom Meeting SDK for Windows can trigger it. The concrete prerequisite is that the target runs an affected Windows Zoom Workplace client/SDK version and is reachable by the attacker's crafted network input; the description names no additional feature toggle or non-default configuration. Limiting factors: the flaw is confined to the Windows client family (not macOS/Linux/mobile or server-side Zoom infrastructure per the supplied data), and Meeting SDK exposure depends on third-party applications having embedded a vulnerable SDK build. The exact vulnerable version range is not specified in the available data, so 'affected' status per endpoint must be confirmed against ZSB-26014.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) signals a worst-case profile: remote, low-complexity, unauthenticated, no user interaction, with full triad impact - precisely the pattern that warrants urgent remediation. However, several corroborating signals are absent: no EPSS score is provided, the CVE is not in CISA KEV, and no proof-of-concept is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. One inconsistency should be flagged: the input tags label this 'Information Disclosure,' while the description and CVSS (I:H) describe full account takeover - the description and vector should be treated as authoritative over the tag. Net assessment: treat as a genuine high priority based on the vector and account-takeover impact, while recognizing that real-world exploitation likelihood is currently unquantified pending EPSS/exploit data.

A remote attacker sends specially crafted, malformed input to a targeted Zoom Windows client or an application embedding the Meeting SDK, abusing the missing input validation to manipulate authentication or session handling and take over the associated account without any credentials or user interaction. Given AV:N/AC:L, the attacker needs only network reachability to the client and no local access. No public proof-of-concept is referenced, so this scenario is inferred from the CVSS vector and description rather than a demonstrated exploit.