Zoom Patches Critical Windows Flaw That Could Enable Account Takeover

Zoom has released security updates for a critical security flaw impacting Zoom Workplace for Windows that could facilitate account takeover. The vulnerability, tracked as CVE-2026-53412 (CVSS score: 9.8), affects Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows. Improper input validation may allow an unauthenticated user to conduct an account takeover via network access.

The latest security fixes also address three high-severity flaws: CVE-2026-53411 (CVSS 7.8) – improper input validation in Zoom Workplace VDI Plugin for Windows before version 6.6.14 that may allow an authenticated user to escalate privileges via local access; CVE-2026-53410 (CVSS 7.0) – a TOCTOU race condition in installation/uninstallation of certain Zoom Clients for Windows that could allow an authenticated local user to escalate privileges; and CVE-2026-53409 (CVSS 7.8) – improper privilege management in Zoom Rooms for Windows before version 7.1.0 that may allow an authenticated user to escalate privileges via local access.

CVE-2026-53410 affects Zoom Workplace for Windows before version 7.0.5, Zoom Workplace VDI Client for Windows before 6.5.17 and 6.6.14, Zoom Workplace VDI plugin for Windows before 6.5.17 and 6.6.14, Zoom Rooms for Windows before 7.0.5, and Remote Control for Zoom Contact Center for Windows before version 7.0.0. As of writing, there are no indications of exploitation in the wild. Users are advised to apply the latest updates.