Zoom has fixed a critical Windows vulnerability that may let an unauthenticated attacker take over a Zoom account through network access. The flaw, tracked as CVE-2026-53412 in security bulletin ZSB-26014, affects older Zoom Workplace and Zoom Workplace VDI clients for Windows. Zoom rates it 9.8 out of 10 and attributes it to improper input validation.[1]
The practical response is to check the installed client, not merely the web account. Standard Zoom Workplace for Windows should be version 7.0.0 or later. VDI users need a fixed release in the branch their organization deploys. Zoom has not published technical exploit details, and there was no public evidence of active exploitation when this article was published. The company revised the bulletin on July 15 to remove Meeting SDK from the affected-product list, so older summaries that still include it are no longer current.
Who is affected by CVE-2026-53412?
The bulletin names Windows clients only. macOS, Linux, Android, iOS, and the Zoom Meeting SDK are not listed as affected by this CVE. Use the fixed-version boundary that matches the product actually installed:
| Zoom product | Version that includes the fix |
|---|---|
| Zoom Workplace for Windows | 7.0.0 or later |
| Zoom Workplace VDI Client for Windows, 7.0 branch | 7.0.10 or later |
| Zoom Workplace VDI Client for Windows, 6.6 branch | 6.6.15 or later |
| Zoom Workplace VDI Client for Windows, 6.5 branch | 6.5.18 or later |
A version below the applicable threshold is affected. A newer number in a different VDI branch is not automatically the right package for your environment; enterprise VDI deployments should follow the branch and host/client compatibility policy set by the administrator.
How to check your Zoom version on Windows
- Open the Zoom Workplace desktop application.
- Select your profile picture, then choose Help and About Zoom Workplace.
- Compare the displayed number with the fixed threshold above. Zoom’s official guide also explains how VDI users can inspect the VDI client version from the Windows notification-area icon.[2]
Do not use the browser’s Zoom website version, an installer filename, or the date the PC was purchased as a substitute. The number shown by the running Windows client is what determines whether the vulnerable build is still present. Keeping collaboration apps current is also part of the broader remote-work security baseline.
How to install the fixed Zoom release
- In Zoom Workplace, select your profile picture and choose Check for Updates.
- Install the offered release, restart Zoom if requested, then reopen About Zoom Workplace and verify the new version.
- If the update option is absent, your organization may manage Zoom with an MSI package. Do not work around that policy with an unknown installer: contact IT or the Zoom administrator and cite CVE-2026-53412 and ZSB-26014.
- If the device is not centrally managed, use Zoom’s official Download Center rather than an ad, mirror, or emailed download link.
Zoom documents both the in-app update flow and the reason MSI-managed installations may not expose the update button.[3] VDI users should involve their administrator because the Windows VDI client, virtual desktop host components, and deployment branch may be controlled separately.
What the Zoom bulletin does and does not say
The published severity vector describes a network-reachable attack with low complexity, no prior privileges, and no user interaction, with high potential impact to confidentiality, integrity, and availability. Zoom summarizes the outcome as account takeover. It does not explain the request format, affected feature, authentication artifact, or a reliable log signature. That lack of detail means defenders should prioritize version inventory and patch completion instead of guessing at exploit indicators.
A successful update closes this specific software vulnerability; it does not prove that an account was never accessed before the update. Conversely, the existence of a vulnerable build does not by itself show that the account was compromised.
What to do if your Zoom account behaves strangely
- Update the Windows client first and record the old and new version numbers.
- From a trusted device, change the Zoom password if you use a Zoom-managed login. If the organization uses SSO, notify the identity and Zoom administrators instead of changing unrelated passwords blindly.
- Review meetings, recordings, account users, apps and integrations, and other administrative changes that your role can see. Remove or report anything you do not recognize.
- Sign out other sessions or have an administrator revoke access where available. Preserve timestamps, email alerts, participant reports, and audit logs before deleting evidence.
- Report a suspected compromised account to Zoom Trust & Safety or through the organization’s support channel.[4]
Users do not need to remove Zoom if they can install a fixed build. The useful checkpoint is simple: identify the exact Windows or VDI client, reach the appropriate fixed version, and confirm that version after the application restarts.
References
- Zoom. “ZSB-26014: Improper Input Validation in Zoom Clients for Windows.” Initial publication July 14, revised July 15, 2026. Security bulletin and affected versions.
- Zoom Support. “Viewing the Zoom Workplace desktop and mobile app version.” Accessed July 15, 2026. Official version-check instructions.
- Zoom Support. “Updating Zoom to the latest version.” Accessed July 15, 2026. Official update instructions.
- Zoom Support. “Reporting a compromised account.” Accessed July 15, 2026. Official account-reporting guidance.
