Description Summary:
Zoom Workplace for Windows is vulnerable to an improper input validation flaw that may enable account takeover by an unauthenticated attacker.

Executive Summary:
A critical input validation vulnerability in the Zoom Workplace client for Windows allows remote attackers to compromise user accounts.

Vulnerability Details

CVE-ID: CVE-2026-53412

Affected Software: Zoom Communications Zoom Workplace for Windows

Affected Versions: 0 up to (excluding) 7.0.0

Vulnerability: This is an improper input validation vulnerability affecting the Zoom Desktop Client, VDI Client, and Meeting SDK for Windows. It permits an unauthenticated attacker with network access to execute an account takeover.

Business Impact

The CVSS score of 9.8 reflects the high potential for total system and account compromise. Successful exploitation could lead to unauthorized access to internal meetings, sensitive communications, and corporate credentials, causing significant privacy and security impacts for enterprise users.

Remediation Plan

Immediate Action: Update all instances of Zoom Workplace, Zoom VDI Client, and the Zoom Meeting SDK for Windows to version 7.0.0 or later.

Proactive Monitoring: Monitor network traffic for unusual patterns targeting Zoom client interfaces and ensure that endpoint security solutions are updated to detect exploitation attempts.

Compensating Controls: Restrict network access to Zoom endpoints to trusted networks and ensure that the Windows host is hardened against unauthorized external connections.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires network access to the target client.

Analyst Recommendation

Given the critical severity of this account takeover flaw, all organizations utilizing the Zoom Windows ecosystem must deploy the 7.0.0 update across their environment immediately. Failure to update leaves users exposed to potential credential theft and unauthorized access via network-based attacks.

Description Summary:
A TOCTOU race condition in the Zoom Workplace VDI Plugin for Windows allows authenticated local users to escalate privileges during installation or uninstallation.

Executive Summary:
A local privilege escalation vulnerability in the Zoom Workplace VDI Plugin could allow an authenticated user to gain elevated system permissions.

Vulnerability Details

CVE-ID: CVE-2026-53411

Affected Software: Zoom Zoom Workplace VDI Plugin

Affected Versions: 0 up to (excluding) 6.6.14

Vulnerability: This is a time-of-check to time-of-use (TOCTOU) race condition within the installation and uninstallation process of the software. An authenticated local user can exploit this logic flaw to manipulate the process and escalate their privileges on the host system.

Business Impact

The ability for a local user to escalate privileges poses a severe risk, as it allows attackers to bypass standard system security boundaries. With a CVSS score of 7.8, this vulnerability could facilitate full system compromise if an attacker gains initial low-level access to a workstation or server.

Remediation Plan

Immediate Action: Update the Zoom Workplace VDI Plugin to version 6.6.14 or later.

Proactive Monitoring: Monitor system logs for suspicious process execution patterns or unauthorized attempts to modify installation directories.

Compensating Controls: Restrict local user permissions on systems where the Zoom VDI plugin is deployed to minimize the potential for local exploitation.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Race conditions are often difficult to exploit reliably but represent a critical failure in secure software installation practices.

Analyst Recommendation

Given the potential for privilege escalation, organizations should deploy the updated version of the Zoom Workplace VDI Plugin as part of their next scheduled maintenance cycle.

Description Summary:
Zoom Rooms for Windows contains an improper privilege management vulnerability that may allow an authenticated local user to perform unauthorized actions.

Executive Summary:
An improper privilege management flaw in Zoom Rooms for Windows could allow an authenticated local user to escalate privileges and impact system integrity.

Vulnerability Details

CVE-ID: CVE-2026-53409

Affected Software: Zoom Zoom Rooms

Affected Versions: 0 up to (excluding) 7.1.0

Vulnerability: The application suffers from improper privilege management, which allows an authenticated local user to interact with the software in a way that bypasses intended security controls. This flaw potentially grants the user capabilities beyond their authorized level.

Business Impact

The CVSS score of 7.8 reflects the high severity of allowing local privilege escalation, which can lead to total loss of confidentiality, integrity, and availability on the affected host. Such vulnerabilities are commonly used to move laterally or establish persistence within an environment.

Remediation Plan

Immediate Action: Update Zoom Rooms for Windows to version 7.1.0 or later to ensure proper privilege management.

Proactive Monitoring: Audit local system logs for unexpected privilege changes or unauthorized execution of administrative tasks by standard user accounts.

Compensating Controls: Implement strict application control policies to ensure that only authorized users can interact with sensitive binary files associated with Zoom Rooms.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Privilege management issues are significant risks that require timely patching to maintain a secure baseline.

Analyst Recommendation

Administrators must prioritize the update of all Zoom Rooms installations to the latest version to remediate this privilege management defect and protect against local exploitation.

Description Summary:
A privilege escalation vulnerability exists in the Zoom Workplace custom URL scheme handler, allowing unauthenticated network-based attackers to elevate their access rights.

Executive Summary:
An improper authorization vulnerability in the Zoom Workplace URL scheme allows unauthenticated network attackers to escalate privileges within the application.

Vulnerability Details

CVE-ID: CVE-2026-53408

Affected Software: Zoom Workplace

Affected Versions: Zoom Workplace before version 7.0.4 for Android and before version 7.0.3 for iOS.

Vulnerability: This is an improper authorization vulnerability in the handler for the custom URL scheme. An unauthenticated attacker with network access can exploit this flaw to escalate privileges within the application.

Business Impact

The CVSS score of 8.1 underscores the critical nature of this privilege escalation flaw. If exploited, an attacker could gain unauthorized administrative or elevated access, resulting in potential data theft, session hijacking, and compromise of communication integrity within the organization.

Remediation Plan

Immediate Action: Update all instances of Zoom Workplace to version 7.0.4 for Android or 7.0.3 for iOS.

Proactive Monitoring: Review enterprise mobile logs for anomalous activity or unexpected URL scheme calls that deviate from standard user behavior.

Compensating Controls: Utilize endpoint security controls to monitor and restrict the execution of custom URL schemes that are not explicitly required for business operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for privilege escalation, it is imperative to enforce the update to the latest versions of Zoom Workplace across all mobile devices. Security teams should prioritize this deployment to prevent unauthorized escalation and ensure platform integrity.

Description Summary:
An improper authorization vulnerability in the Zoom Workplace custom URL scheme handler allows unauthenticated users to perform privilege escalation via network access.

Executive Summary:
An improper authorization flaw in the Zoom Workplace URL scheme enables unauthenticated users to escalate privileges, necessitating an immediate application update.

Vulnerability Details

CVE-ID: CVE-2026-53407

Affected Software: Zoom Workplace

Affected Versions: Zoom Workplace before version 7.0.4 for Android and before version 7.0.3 for iOS.

Vulnerability: This is an improper authorization vulnerability within the handler for the custom URL scheme. An unauthenticated user can leverage this flaw via network access to elevate their privileges within the application context.

Business Impact

The CVSS score of 8.1 reflects the high risk associated with privilege escalation. Successful exploitation allows an attacker to bypass established security controls, potentially gaining access to sensitive user data or administrative functions within the Zoom environment, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: Upgrade Zoom Workplace to version 7.0.4 for Android or 7.0.3 for iOS or later versions.

Proactive Monitoring: Monitor device and application logs for unusual usage patterns or unauthorized attempts to trigger custom URL schemes within the organizational Zoom instance.

Compensating Controls: Implement mobile device management (MDM) policies to restrict unauthorized network access and enforce application version compliance across the enterprise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a clear risk to mobile device security and internal Zoom data integrity. Administrators should ensure all mobile endpoints are updated to the specified versions immediately to neutralize the privilege escalation vector.

Description Summary:
Zoom Contact Center for Windows contains a vulnerability involving insufficient verification of data authenticity during remote control sessions.

Executive Summary:
Zoom Contact Center for Windows prior to version 7 contains a data authenticity vulnerability that could allow for unauthorized remote control actions.

Vulnerability Details

CVE-ID: CVE-2026-53406

Affected Software: Zoom Contact Center

Affected Versions: Versions before 7

Vulnerability: The application fails to perform sufficient verification of data authenticity during remote control operations. This could allow an attacker to bypass security checks and perform unauthorized actions within the remote control session.

Business Impact

The CVSS score of 7.8 (High) reflects the severity of allowing unauthorized remote control of a workstation. This could lead to the theft of sensitive information, installation of malware, or complete administrative control over the affected system, resulting in severe reputational and operational damage.

Remediation Plan

Immediate Action: Update the Zoom Contact Center for Windows client to version 7 or later immediately.

Proactive Monitoring: Review audit logs for remote control sessions and unauthorized administrative changes made to workstations.

Compensating Controls: Disable remote control features within the Zoom Contact Center application if they are not strictly required for business operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations using Zoom Contact Center must prioritize upgrading all Windows clients to version 7 or higher. This update is critical to closing the gap in remote control authenticity verification and protecting against potential system compromise.

Description Summary:
A path traversal vulnerability in the Mail feature of Zoom Workplace for Windows allows unauthenticated users to conduct an escalation of privilege via network access.

Executive Summary:
A critical privilege escalation vulnerability in Zoom Workplace for Windows allows unauthenticated attackers to gain elevated system permissions by exploiting a file path control flaw.

Vulnerability Details

CVE-ID: CVE-2026-30903

Affected Software: Zoom Workplace for Windows

Affected Versions: Before 6.6.0

Vulnerability: The vulnerability involves "External Control of File Name or Path" within the Zoom Mail feature. An unauthenticated attacker with network access can exploit this flaw to manipulate file paths, potentially leading to the execution of malicious files or the overwriting of sensitive system components to escalate privileges.

Business Impact

A successful exploit could allow an attacker to gain administrative rights on a user's workstation, leading to data theft, malware installation, and persistent access to the corporate network. The CVSS score of 9.6 reflects the high risk of unauthorized privilege elevation on end-user devices.

Remediation Plan

Immediate Action: Update Zoom Workplace for Windows to version 6.6.0 or later immediately.

Proactive Monitoring: Use endpoint detection and response (EDR) tools to monitor for suspicious file system activity or unusual process spawning originating from the Zoom application.

Compensating Controls: Ensure that users do not have local administrative rights, which can limit the impact of privilege escalation vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation. However, Zoom's large install base makes it a primary target for sophisticated threat actors seeking to compromise corporate endpoints.

Analyst Recommendation

Privilege escalation in widely deployed communication software is a critical threat. IT administrators must ensure that all Windows endpoints are running the latest version of Zoom Workplace to mitigate this risk and protect the organization's fleet of devices.

Description Summary:
Zoom Clients for Windows contain an improper privilege management vulnerability that allows a local authenticated user to escalate privileges.

Executive Summary:
A vulnerability in Zoom Workplace for Windows allows local authenticated users to escalate privileges, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-30902

Affected Software: Zoom Workplace

Affected Versions: See vendor advisory

Vulnerability: This is an improper privilege management flaw (CWE-269) within the Zoom client for Windows. The vulnerability requires the attacker to be an authenticated user with local access to the target machine to successfully trigger the privilege escalation.

Business Impact

Successful exploitation of this vulnerability allows an authenticated local user to gain unauthorized elevated privileges on the host system. This level of access could lead to full system compromise, including the ability to install malicious software, access sensitive data, or modify system configurations, justifying the high CVSS score of 7.8.

Remediation Plan

Immediate Action: Review the official Zoom security bulletin (ZSB-26004) to identify the specific patched versions for your installation and update the software immediately.

Proactive Monitoring: Monitor local system logs for unusual process execution or unauthorized changes to administrative account privileges.

Compensating Controls: Implement endpoint detection and response (EDR) solutions to identify and block suspicious local privilege escalation attempts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for local access and pre-existing authentication mitigates the risk of remote attacks, but the potential for full system impact necessitates prompt attention.

Analyst Recommendation

Given the high severity of potential privilege escalation, organizations should prioritize updating all Zoom Workplace client instances on Windows systems. Administrators should verify the specific versions mentioned in the official Zoom security advisory to ensure complete coverage across their environment.

Description Summary:
A vulnerability in the update functionality of Zoom Workplace for Windows allows an authenticated local user to perform an escalation of privilege.

Executive Summary:
A high-severity privilege escalation vulnerability in Zoom Workplace for Windows, tracked as CVE-2026-30900, allows authenticated local users to gain elevated system access.

Vulnerability Details

CVE-ID: CVE-2026-30900

Affected Software: Zoom Workplace

Affected Versions: 6.6.0 up to (excluding) 6.6.11

Vulnerability: The flaw is caused by an improper check of the minimum version within the update mechanism (CWE-754). This vulnerability requires the attacker to have authenticated local access to the target system to trigger the escalation.

Business Impact

This vulnerability poses a significant risk to organizational endpoint security, as it allows a standard authenticated user to escalate privileges to a higher level. With a CVSS score of 7.8, the potential for total compromise of the local machine is high, which could lead to unauthorized data access, lateral movement within the network, or the installation of malicious software.

Remediation Plan

Immediate Action: Update Zoom Workplace to version 6.6.11 or later immediately to resolve the improper version check.

Proactive Monitoring: Review system logs for unusual process execution patterns or unexpected administrative actions performed by standard user accounts.

Compensating Controls: Ensure that local user permissions follow the principle of least privilege, restricting the ability of standard users to execute unauthorized installers or modify system-level configurations.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for local access typically limits the attack surface to users already present on the host system.

Analyst Recommendation

Given the potential for full system privilege escalation, organizations should prioritize the deployment of the 6.6.11 update across all Windows workstations running Zoom Workplace. Immediate patching is the most effective way to eliminate this risk, as local privilege escalation flaws are frequently used in the later stages of a broader cyberattack.

Description Summary:
A command injection vulnerability in Zoom Node Multimedia Routers allows an authenticated meeting participant to execute arbitrary system commands via network access.

Executive Summary:
A critical command injection vulnerability in Zoom Node allows remote code execution by a meeting participant, posing a severe risk to infrastructure integrity.

Vulnerability Details

CVE-ID: CVE-2026-22844

Affected Software: Zoom Communications Inc. Zoom Node

Affected Versions: 0 up to (excluding) 5.2.1716.0

Vulnerability: This is a command injection flaw (CWE-78) occurring in Multimedia Routers (MMRs) that allows a logged-in meeting participant to execute unauthorized OS commands on the underlying system. The vulnerability requires low privileges (an authenticated meeting participant) but does not require user interaction to trigger.

Business Impact

The ability for a remote attacker to gain code execution at the system level represents a catastrophic security failure. Successful exploitation could lead to full system compromise, unauthorized access to sensitive meeting data, and lateral movement within the corporate network, warranting a critical severity rating based on the 9.9 CVSS score.

Remediation Plan

Immediate Action: Update all instances of Zoom Node Multimedia Routers to version 5.2.1716.0 or later immediately to patch the command injection vector.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from MMR servers and review system logs for unexpected process execution or shell activity.

Compensating Controls: Restrict network access to MMR infrastructure to trusted internal segments and employ a Web Application Firewall (WAF) or network inspection tool to detect and block malicious command strings.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists via the GitHub repository: https://github.com/Ashwesker/Ashwesker-CVE-2026-22844.

Analyst Notes: As of Jan 20, 2026, there is no confirmed active exploitation in the wild; however, the presence of a public proof-of-concept repository elevates the risk of exploitation. The flaw is inherently dangerous due to the lack of input sanitization in the MMR interface.

Analyst Recommendation

Given the critical CVSS score of 9.9 and the availability of a public proof-of-concept, this vulnerability must be treated as a priority for immediate remediation. Administrators should verify their current versioning against the fixed release and apply the update across all affected nodes to prevent potential unauthorized system access.

Description Summary:
A protection mechanism failure in Zoom Rooms for Windows allows local users to perform an unauthorized software downgrade, potentially leading to an escalation of privilege.

Executive Summary:
A vulnerability in Zoom Rooms for Windows allows local attackers to bypass security controls via software downgrades, facilitating potential privilege escalation.

Vulnerability Details

CVE-ID: CVE-2025-67460

Affected Software: Zoom Zoom Rooms

Affected Versions: 0 up to (excluding) 6.6.0

Vulnerability: This is a protection mechanism failure (CWE-693) that allows a local user with low privileges to force an insecure software downgrade, which can subsequently be leveraged to achieve an escalation of privilege.

Business Impact

The ability for a local user to escalate privileges poses a significant risk to the integrity and security of the host system. With a CVSS score of 7.8, this vulnerability is considered High, as it could allow unauthorized actors to gain administrative control over the affected Zoom Room hardware, potentially leading to full system compromise and unauthorized access to organizational resources.

Remediation Plan

Immediate Action: Update all Zoom Rooms for Windows installations to version 6.6.0 or later to ensure the downgrade protection mechanism is correctly enforced.

Proactive Monitoring: Monitor system logs for unexpected software installation events or unauthorized attempts to modify application configuration files on Zoom Room endpoints.

Compensating Controls: Restrict local user access to the host operating system and implement strict application control policies to prevent the execution of unauthorized or legacy installer packages.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires local access, the nature of the flaw makes it a viable target for lateral movement once an attacker has established a foothold on the local machine.

Analyst Recommendation

Given the potential for privilege escalation and the high severity score associated with this flaw, administrators must prioritize the deployment of the 6.6.0 update across all Zoom Room environments. Ensuring that endpoints are running the latest software version is the most effective way to eliminate this attack vector and protect against unauthorized privilege escalation.

Description Summary:
Zoom Workplace for Android contains an improper authorization vulnerability that may allow unauthenticated remote attackers to perform privilege escalation via network access.

Executive Summary:
A critical authorization vulnerability in Zoom Workplace for Android allows unauthenticated attackers to potentially escalate privileges, posing a significant security risk to mobile deployments.

Vulnerability Details

CVE-ID: CVE-2025-64741

Affected Software: Zoom Workplace for Android

Affected Versions: 0 up to (excluding) 6.5.10

Vulnerability: This vulnerability involves improper authorization handling, categorized as an injection-related flaw, which can be triggered by an unauthenticated user via network access to escalate privileges.

Business Impact

The ability for an unauthenticated attacker to escalate privileges represents a high-severity risk to organizational data and communication integrity. With a CVSS score of 8.1, the potential for unauthorized access to sensitive meeting data or user information could lead to significant privacy breaches and loss of trust in internal communication platforms.

Remediation Plan

Immediate Action: Update all instances of Zoom Workplace for Android to version 6.5.10 or later immediately.

Proactive Monitoring: Review mobile device management (MDM) logs and application access logs for unusual patterns or unexpected privilege escalation attempts originating from the Zoom application.

Compensating Controls: Ensure that network-level controls, such as enterprise firewalls or VPNs, are configured to restrict suspicious inbound traffic to mobile devices where possible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of November 14, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability allows for privilege escalation, it requires network access, making it highly important to prioritize patching on mobile devices that frequently connect to untrusted public networks.

Analyst Recommendation

Given the potential for privilege escalation and the high CVSS severity score, organizations should treat this update as a priority for all mobile endpoints. Administrators must ensure that the Zoom Workplace application is updated to version 6.5.10 or later across the entire fleet to eliminate the authorization flaw and mitigate the risk of unauthorized access.

Description Summary:
The Zoom Workplace VDI Client for Windows contains an improper cryptographic signature verification flaw in its installer that allows local authenticated users to escalate privileges.

Executive Summary:
A vulnerability in the Zoom Workplace VDI Client for Windows allows local authenticated users to achieve unauthorized privilege escalation due to insufficient signature verification.

Vulnerability Details

CVE-ID: CVE-2025-64740

Affected Software: Zoom Workplace VDI Client

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability, identified as CWE-347, involves the improper verification of cryptographic signatures during the installation process. An authenticated user with local access can exploit this weakness to escalate their privileges within the host environment.

Business Impact

The ability for a standard user to escalate privileges poses a significant risk to the integrity and security of the workstation. Successful exploitation could lead to full system compromise, unauthorized access to sensitive data, and potential lateral movement within the corporate network. With a CVSS score of 7.5, this high severity flaw necessitates prompt attention to prevent unauthorized administrative control.

Remediation Plan

Immediate Action: Review the official security bulletin ZSB-25042 provided by Zoom and apply all recommended patches or configuration updates to the VDI client immediately.

Proactive Monitoring: Security teams should monitor workstation logs for unauthorized attempts to execute installer processes or abnormal privilege escalation patterns.

Compensating Controls: Restrict local user permissions where possible and utilize endpoint detection and response tools to identify and block suspicious installer behavior.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of November 15, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for local access and specific authentication levels limits the attack surface, but the potential for total impact remains a critical concern for IT administrators.

Analyst Recommendation

Given the high impact of privilege escalation on endpoint security, administrators must prioritize the identification of affected VDI client instances. Ensure that all systems are updated according to the vendor's guidance in bulletin ZSB-25042 to neutralize the threat and maintain a secure computing environment.

Description Summary:
Zoom Workplace clients contain an inefficient regular expression complexity flaw that may allow an unauthenticated user to escalate privileges via network access.

Executive Summary:
A critical vulnerability in Zoom Workplace allows unauthenticated users to perform privilege escalation, posing a significant risk to organizational endpoint security.

Vulnerability Details

CVE-ID: CVE-2025-62484

Affected Software: Zoom Workplace

Affected Versions: 0 up to (excluding) 6.5.10

Vulnerability: The software contains a vulnerability due to inefficient regular expression complexity (CWE-1333), which can be triggered by an unauthenticated attacker to achieve an escalation of privilege through network access.

Business Impact

The ability for an unauthenticated attacker to escalate privileges presents a severe security risk, potentially allowing unauthorized access to sensitive user data or system functions within the Zoom environment. With a CVSS score of 8.1, this vulnerability is classified as High, indicating that successful exploitation could lead to significant compromise of confidentiality and integrity for affected endpoints.

Remediation Plan

Immediate Action: Update all Zoom Workplace clients to version 6.5.10 or later immediately to resolve the identified regular expression complexity flaw.

Proactive Monitoring: Monitor network traffic for unusual patterns or spikes in resource utilization that may indicate an attempt to trigger inefficient regular expressions.

Compensating Controls: Ensure that endpoint security software and firewalls are configured to block suspicious inbound network connections to the Zoom client application where possible.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of November 15, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is classified as high severity, the complexity of crafting a successful exploit for regular expression vulnerabilities often limits the immediate risk of widespread automated attacks.

Analyst Recommendation

Given the potential for privilege escalation, organizations must prioritize the deployment of the 6.5.10 update across all managed Zoom Workplace instances. Security teams should verify that automatic update mechanisms are functioning correctly to ensure rapid remediation and reduce the window of exposure to potential attackers.

Description Summary:
A missing authorization vulnerability in the Zoom Workplace for Windows on ARM installer allows local authenticated users to perform an escalation of privilege.

Executive Summary:
A high-severity local privilege escalation vulnerability in Zoom Workplace for Windows on ARM allows authenticated users to compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2025-49459

Affected Software: Zoom Workplace for Windows on ARM

Affected Versions: 0 up to 6.6.0

Vulnerability: This flaw is classified as a missing authorization issue (CWE-862) occurring within the software installer. It enables an authenticated user with local access to the system to escalate their privileges.

Business Impact

Successful exploitation of this vulnerability allows a local user to gain elevated permissions on an affected workstation, potentially leading to full system compromise. With a CVSS score of 7.8, this vulnerability poses a significant risk to organizational endpoint security, as it facilitates lateral movement or the installation of persistent malicious software by users who should otherwise have limited access.

Remediation Plan

Immediate Action: Update Zoom Workplace for Windows on ARM to version 6.6.0 or later to resolve the authorization flaw.

Proactive Monitoring: Review system logs for unusual installer activity or unexpected privilege changes occurring during or after software maintenance windows.

Compensating Controls: Restrict local user permissions on shared or sensitive workstations using the principle of least privilege to prevent unauthorized execution of installer packages.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of September 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires local access, the potential for total impact on system confidentiality, integrity, and availability makes timely patching a priority.

Analyst Recommendation

Given the high CVSS severity rating, administrators must prioritize the deployment of the vendor-supplied update to all affected ARM-based Windows endpoints. Ensuring that the Zoom client is updated to version 6.6.0 is the only reliable method to eliminate the escalation of privilege path provided by the vulnerable installer.

Description Summary:
An untrusted search path vulnerability in certain Zoom Clients for Windows allows an unauthenticated user to achieve escalation of privilege via network access.

Executive Summary:
A critical untrusted search path vulnerability in Zoom Client for Windows exposes systems to unauthorized privilege escalation by unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2025-49457

Affected Software: Zoom Client for Windows

Affected Versions: See vendor advisory

Vulnerability: This flaw stems from an untrusted search path (CWE-426) within the application, which allows an unauthenticated attacker to manipulate the execution environment. By leveraging network access, an attacker can force the application to load malicious components, leading to an escalation of privileges on the host system.

Business Impact

The ability for an unauthenticated user to escalate privileges on a workstation poses a severe threat to endpoint integrity and organizational data security. Given the 9.6 CVSS score, this vulnerability could allow an attacker to gain full control over the affected system, facilitating lateral movement within the network or the theft of sensitive credentials. Such compromises result in significant operational disruption and potential long-term damage to corporate security posture.

Remediation Plan

Immediate Action: Review the official Zoom security bulletin at https://www.zoom.com/en/trust/security-bulletin/zsb-25030 and apply all recommended updates to the Zoom Client for Windows immediately.

Proactive Monitoring: Monitor endpoint security logs for unexpected process execution, unauthorized service installation, or unusual network traffic patterns originating from the Zoom application directory.

Compensating Controls: Ensure that endpoint protection software is configured to detect and block unauthorized binary loading or suspicious DLL injection attempts, which are common vectors for this type of vulnerability.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 12, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly exploitable due to the lack of required authentication, the absence of public exploit code provides a limited window for proactive patching.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention from IT and security teams. Administrators should prioritize identifying all instances of the Zoom Client for Windows within their environment and deploying the vendor-supplied security updates as soon as they are available to prevent potential system compromise.

Description Summary:
Zoom Workplace for Linux contains an improper certificate validation vulnerability that may permit unauthorized information disclosure via network access.

Executive Summary:
A critical improper certificate validation flaw in Zoom Workplace for Linux exposes users to potential information disclosure attacks via network-based interception.

Vulnerability Details

CVE-ID: CVE-2025-46788

Affected Software: Zoom Workplace for Linux

Affected Versions: 0 up to (excluding) 6.4.13

Vulnerability: This vulnerability involves improper certificate validation (CWE-295) within the Zoom application. An unauthenticated attacker positioned on the network could exploit this weakness to intercept sensitive communications.

Business Impact

Successful exploitation of this vulnerability can lead to the compromise of confidential data transmitted during Zoom sessions. Given the CVSS score of 7.4, this represents a high-severity risk that could result in unauthorized access to sensitive corporate communications, potentially leading to reputational damage or the loss of proprietary information.

Remediation Plan

Immediate Action: Update Zoom Workplace for Linux to version 6.4.13 or later immediately to resolve the certificate validation issue.

Proactive Monitoring: Security teams should review network logs for unusual traffic patterns originating from or directed toward endpoints running Zoom Workplace for Linux.

Compensating Controls: Ensure that all network traffic is inspected via encrypted tunnels or VPNs to reduce the risk of interception by unauthorized parties on the local network segment.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw requires the attacker to have network access to perform the interception, the impact on data confidentiality makes immediate patching a priority.

Analyst Recommendation

Organizations utilizing Zoom Workplace for Linux must prioritize upgrading their installations to version 6.4.13. Due to the high potential for information disclosure during network-based attacks, failure to apply this update leaves the environment vulnerable to interception by unauthorized actors.