EUVD-2026-98747
GHSA-jr7h-fcjv-q5wj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious custom-URL-scheme link
-
ExploitDeliver link to Android victim
-
ExecutionBypass authorization in URL handler
-
ImpactEscalate privileges within Zoom app
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V4 - API and Web Service Improper authorization in handler
|
| Exploitation Conditions | Requires the Zoom Workplace for Android client at a version before 7.2.1 to be installed on the target device, and the attacker must get the device to process a malicious custom URL scheme (CWE-939) - typically via a crafted link or a co-resident app invoking the handler. Exploitation is LIMITED to the Android client (iOS/desktop not indicated), only versions prior to 7.2.1, and realistically to a path where the handler is invoked. Note the unresolved conflict over authentication: the description implies no authentication while the CVSS vector implies a low-privileged authenticated session is needed - confirm with Zoom before treating as fully unauthenticated. |
| Impact | This is a genuinely high-priority mobile vulnerability but with important caveats. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) scores 8.1 with high confidentiality and integrity impact, implying low attacker effort. However, there is a direct CONFLICT in the source data: the description states 'an unauthenticated user' may exploit this, while the CVSS vector encodes PR:L (authenticated). Per precision rules, authentication requirements cannot be stated with confidence - verify with Zoom whether a Zoom account/session is actually required. A second tension: CWE-939 (improper authorization in a custom URL scheme handler) on Android is typically triggered by a crafted link or a malicious co-installed app and usually involves some user or application interaction, yet the vector claims UI:N and AV:N. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automatable exploitation. Net: treat as a real patch priority given high impact and the ubiquity of the Zoom mobile client, but the 8.1 is driven by vendor metrics that partially conflict with the described exploitation mechanics - do not assume trivial remote unauthenticated compromise until the handler trigger path is confirmed. |
| Exploit ScenarioDerived | An attacker crafts a malicious custom URL scheme link (e.g., delivered via a web page, message, or another app) that targets the Zoom Workplace for Android URL handler. When the link is processed by a device running a version before 7.2.1, the improper authorization check is bypassed, letting the attacker perform actions or access data at a higher privilege level than intended. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Privilege escalation in the custom URL scheme handler of Zoom Workplace for Android before version 7.2.1 allows an attacker who can get the device to process a crafted link or invoke the handler (for example via a co-resident malicious app) to gain capabilities beyond those the invoking context should hold, with high confidentiality and integrity impact per the assessed CVSS of 8.1. Only the Android client is indicated; iOS and desktop builds are not referenced in the affected CPE, and installations at 7.2.1 or later are not affected. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the authentication prerequisite is genuinely ambiguous: the description suggests an unauthenticated network attacker while the published CVSS vector (PR:L) and the independent assessment differ on whether any session is required, so treat the exploitability preconditions as unresolved pending confirmation from Zoom. Note that the vendor vector (PR:L/UI:N) and the assessed vector (PR:N/UI:R) diverge, meaning it is not settled whether success needs a low-privileged session or user interaction with a crafted link.
RemediationAI
Upgrade Zoom Workplace for Android to version 7.2.1 or later; this is the vendor-released patch and the only fix identified in the available data. Distribute the update through managed Google Play or your MDM/EMM catalog and verify installed versions, since Android clients frequently lag behind store availability, and consult Zoom's advisory at https://www.zoom.com/en/trust/security-bulletin/zsb-26019 for the official version guidance and any vendor-supplied mitigations. Where immediate upgrading is not feasible, compensating controls carry trade-offs: restrict installation of untrusted or sideloaded apps on managed devices (reduces the co-resident-app invocation path but not crafted-link delivery), enforce managed browsing and link-preview protections so users are less likely to open attacker-supplied deep links (impacts usability of legitimate Zoom links), and constrain device access to sensitive data through Android work profiles or containerization to limit what a successful escalation can reach (adds administrative overhead and can break cross-profile workflows). If the product supports disabling or restricting custom-scheme/deep-link handling via managed app configuration, applying that restriction narrows the attack surface but may break join-meeting links and in-app navigation until the upgrade is completed. Because authentication requirements are not confirmed from the available data, do not treat any single control as a complete substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-939, Improper Authorization in Handler for Custom URL Scheme, a mobile-specific weakness in which an application registers a URI scheme (deep link) handler but fails to properly validate or authorize the caller or the parameters before acting on the request. On Android, custom scheme handlers are surfaced through intent filters and exported components; when authorization checks are missing or insufficient, any app on the device - or a crafted link a user is induced to open - can drive the handler into performing privileged operations, effectively escalating the caller's privileges inside the Zoom client's context. The affected CPE cpe:2.3:a:zoom_communications:zoom_workplace:*:*:*:*:*:*:*:* with a wildcard version and an Android-specific advisory indicates the flaw is in the Android client code path for handling custom URL schemes across versions prior to 7.2.1. Because the impact is scoped as C:H/I:H/A:N in both the vendor and assessed vectors, the practical effect is disclosure and modification of data reachable by the Zoom app rather than a guaranteed full device compromise, though the app typically holds camera, microphone, contacts, and meeting-data privileges that make this meaningful.
Know when Zoom Workplace gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Custom-URL-scheme handler is reached via a network-delivered link that a user must open (AV:N, UI:R); description indicates no prior authentication (PR:N); high C/I impact, no availability effect.
Primary rating from Vendor (Zoom).
CVSS VectorVendor: Zoom
Lifecycle Timeline
2DescriptionCVE.org
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access.
Articles & Coverage 1
Executive ViewAI
Zoom Workplace for Android versions before 7.2.1 contain a high-severity privilege escalation issue in the custom URL scheme handler that can allow a malicious app or crafted link to exceed intended permissions on a user's device, impacting confidentiality and integrity. Organizations with Android-based mobile workforces should treat this as a material risk because it targets corporate communications and data on endpoints, even though no public exploit has been identified at time of analysis. Leadership should prioritize inventory, interim hardening, and vendor engagement because no vendor-released patch is available at this time.
No vendor-released patch identified at time of analysis; interim mitigations include restricting or disabling custom URL scheme handling for Zoom Workplace for Android via MDM, blocking untrusted links, enforcing least privilege, using mobile threat defense, monitoring for anomalous behavior, and user awareness to avoid suspicious links or app prompts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Zoom Workplace
View allPrivilege escalation in the Zoom Workplace mobile app (Android before 7.0.4, iOS before 7.0.3) stems from improper autho
Privilege escalation in Zoom Workplace mobile clients (Android before 7.0.4, iOS before 7.0.3) stems from improper autho
Zoom Workplace clients with the Zoom Phone feature contain a network-reachable buffer overflow (CWE-120) that can lead t
Information disclosure in Zoom Workplace for iOS before version 7.0.0 allows an authenticated user with physical access
Exploit-DB