Zoom Warns of Critical Account-Takeover Flaw in Windows Clients

SAN JOSE, California — Zoom has warned of a critical vulnerability in its Windows desktop client and software development kit that could allow an unauthenticated attacker to take over user accounts, according to BleepingComputer (https://www.bleepingcomputer.com/news/security/zoom-warns-of-critical-account-takeover-vulnerability/). The flaw, tracked as CVE-2026-53412 and rated 9.8 out of 10 on the CVSS scale, was discovered internally by the company and affects Zoom Workplace for Windows before version 7.0.0, the Windows VDI Client before versions 7.0.10, 6.6.15 and 6.5.18, and the Meeting SDK for Windows before version 7.0.0, Zoom said in a security advisory (https://www.zoom.com/en/trust/security-bulletin/zsb-26014/). Zoom described the issue as an "improper input validation" weakness. "Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network access," the company wrote in the advisory. The vendor did not publish technical details of the flaw beyond that description, BleepingComputer reported. The Windows desktop client is widely deployed and used by millions of people and organizations, the outlet noted. Zoom's latest patches also addressed three less severe, high-rated flaws: CVE-2026-53410, a time-of-check-to-time-of-use race condition; CVE-2026-53409, an improper privilege-management issue in Zoom Rooms for Windows; and CVE-2026-53411, another improper input-validation flaw in the VDI Plugin, according to the company's bulletins (https://www.zoom.com/en/trust/security-bulletin/zsb-26012/; https://www.zoom.com/en/trust/security-bulletin/zsb-26011/; https://www.zoom.com/en/trust/security-bulletin/zsb-26013/). At the time of disclosure, there were no indications that any of the fixed vulnerabilities were being exploited in attacks, BleepingComputer reported. Zoom recommended that users install the latest updates (https://zoom.us/download).