Zoom Clients EUVD-2026-98767

Exploitation requires the attacker to hold a man-in-the-middle / on-path position on the network carrying the Zoom client's My Notes feature traffic (e.g., shared or public Wi-Fi, a compromised gateway, or DNS/ARP spoofing) so that a fraudulent certificate can be presented to the client. The improper certificate validation in the My Notes feature is the exploited weakness. Limiting factors: the on-path prerequisite is non-trivial (reflected as AC:H), exploitation is confined to the specific My Notes feature rather than all client traffic, and only confidentiality (data disclosure) is clearly implicated by the description; no authentication or user interaction is needed once the attacker is positioned.

This is a genuine but conditional threat rather than a drop-everything emergency. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes a network, unauthenticated flaw with HIGH attack complexity - the AC:H is the decisive signal: improper certificate validation (CWE-295) almost always requires the attacker to already occupy a privileged network position (man-in-the-middle / on-path) to present and have accepted a forged or substituted certificate. No EPSS score, SSVC decision, KEV listing, or POC indicator was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 7.4 score is driven by HIGH confidentiality and integrity impact, but the real-world probability is tempered by the on-path prerequisite. Note a conflict to verify with the vendor: the input CVSS marks I:H, yet the description characterizes the issue strictly as information disclosure, which would normally imply confidentiality impact only - the integrity rating appears inconsistent with the stated effect and should be confirmed against Zoom bulletin ZSB-26022.

An attacker on the same network path as a victim (e.g., shared/public Wi-Fi, compromised router, or rogue access point) intercepts the TLS connection used by the Zoom client's My Notes feature and presents a fraudulent certificate that the client fails to properly validate. Because validation is improper, the client trusts the malicious endpoint and the attacker can read sensitive data transmitted by the feature. No public exploit code is identified at time of analysis, and success depends on the attacker first achieving an on-path position.