A critical input validation vulnerability in the Zoom Workplace client for Windows allows remote attackers to compromise user accounts.

This is an improper input validation vulnerability affecting the Zoom Desktop Client, VDI Client, and Meeting SDK for Windows. It permits an unauthenticated attacker with network access to execute an account takeover.

The CVSS score of 9.8 reflects the high potential for total system and account compromise. Successful exploitation could lead to unauthorized access to internal meetings, sensitive communications, and corporate credentials, causing significant privacy and security impacts for enterprise users.

Immediate Action: Update all instances of Zoom Workplace, Zoom VDI Client, and the Zoom Meeting SDK for Windows to version 7.0.0 or later.

Proactive Monitoring: Monitor network traffic for unusual patterns targeting Zoom client interfaces and ensure that endpoint security solutions are updated to detect exploitation attempts.

Compensating Controls: Restrict network access to Zoom endpoints to trusted networks and ensure that the Windows host is hardened against unauthorized external connections.

Public Exploit Available: No

Given the critical severity of this account takeover flaw, all organizations utilizing the Zoom Windows ecosystem must deploy the 7.0.0 update across their environment immediately. Failure to update leaves users exposed to potential credential theft and unauthorized access via network-based attacks.