What is the CVSS score of CVE-2026-53416?

CVE-2026-53416 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Zoom VDI Client are affected by CVE-2026-53416?

Zoom VDI Client and Plugins contain a path traversal vulnerability (CVE-2026-53416) that allows authenticated local users to bypass directory restrictions and access sensitive files or modify system…. A patch is available.

How to fix or mitigate CVE-2026-53416?

Within 24 hours, conduct an inventory of all Zoom VDI Client versions deployed across your VDI infrastructure and identify systems running vulnerable versions. Within 7 days, implement compensating controls: enforce principle of least privilege for local file system access, enable file integrity monitoring (FIM) on critical directories, and restrict local administrative privileges for end users. Within 30 days, establish a tracking process with Zoom support for patch availability, test patches in a non-production environment upon release, and plan a staged rollout to all affected systems.

Zoom VDI Client CVE-2026-53416

EUVD-2026-56246 HIGH

Relative Path Traversal (CWE-23)

2026-08-11 Zoom

GHSA-29rx-299h-2mqg

Information Disclosure Path Traversal Zoom Vdi Zoom Communications

7.1

CVSS 3.1 · Vendor: Zoom

Severity by source

Vendor (Zoom) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.1 HIGH

Local vector confirmed by description; low privilege required for authenticated local session; no availability impact described.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Zoom).

CVSS VectorVendor: Zoom

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Aug 11, 2026 - 17:02 EUVD

Analysis Generated

Aug 11, 2026 - 16:39 vuln.today

CVE Published

Aug 11, 2026 - 16:02 cve.org

HIGH 7.1

DescriptionCVE.org

Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access.

AnalysisAI

Path traversal (CWE-23) in Zoom VDI Client and Plugins exposes authenticated local users to information disclosure and potential file integrity impact by allowing directory escape via crafted path input. Affected are all tracked versions under cpe:2.3:a:zoom_communications:zoom_vdi. No public exploit code or CISA KEV listing exists at time of analysis, but the High confidentiality and integrity impact ratings warrant prompt patching in VDI environments where insider or post-compromise scenarios are relevant threats.

Technical ContextAI

Zoom VDI (Virtual Desktop Infrastructure) Client and its plugins facilitate Zoom functionality within virtualized desktop environments - commonly deployed in healthcare, finance, and enterprise settings to deliver desktop applications over thin-client or remote sessions. CWE-23 (Relative Path Traversal) indicates the software fails to canonicalize or sanitize path components before using them in file operations, allowing sequences such as '../' to escape the intended working directory and reference arbitrary filesystem locations. The affected CPE cpe:2.3:a:zoom_communications:zoom_vdi:*:*:*:*:*:*:*:* covers all versions with no version bound specified in current NVD data, suggesting broad version exposure until a specific fixed release is confirmed. The CVSS vector AV:L confirms the vulnerability is exercised via local access to the host or VDI session.

RemediationAI

Consult and apply the fix detailed in the Zoom security bulletin at https://www.zoom.com/en/trust/security-bulletin/zsb-26017; the exact patched version is not independently confirmed from available NVD data and must be verified against the vendor advisory directly. Until patching is complete, restrict local user privileges on VDI endpoints to the minimum necessary and audit VDI plugin configurations to limit the directories accessible by the Zoom client process. If the VDI deployment allows it, consider running the Zoom VDI client in an isolated sandbox or container with filesystem access controls (e.g., AppArmor or SELinux profiles) restricting path traversal outside designated directories - note this may require testing against Zoom VDI functionality to avoid disruption. Prioritize patching on endpoints where VDI sessions are shared among multiple users or where sensitive data resides on the local filesystem.