CVE-2026-53412: Unauthenticated Remote Account Takeover in Zoom Desktop Client, VDI Client, and Meeting SDK for Windows

CVE-2026-53412 (TL-2026-1407), also tracked as ZSB-26014, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-16. It has no confirmed attribution, affects Zoom Zoom Workplace for Windows (Desktop Client), references 4 CVEs (CVE-2026-53412, CVE-2026-53410, CVE-2026-53409), maps to 20 MITRE ATT&CK techniques (T1068, T1078, T1082), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-1407

Threat ID
TL-2026-1407
Also known as
ZSB-26014
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-16
Last reviewed
2026-07-16
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, corporate enterprise, government administration, finance, health, education, professional services
Target regions
Global
Detection rules
9
Indicators of compromise
18

Zoom disclosed CVE-2026-53412 (CVSS 9.8), an improper input validation flaw in Zoom Workplace for Windows, the Zoom Workplace VDI Client for Windows, and Zoom Meeting SDK for Windows that allows an unauthenticated remote attacker to take over a user's Zoom account over the network without any victim interaction. Fixed in Zoom Workplace 7.0.0+, VDI Client 7.0.10/6.6.15/6.5.18+, and Meeting SDK 7.0.0+; discovered internally by Zoom's Offensive Security team with no active exploitation or public PoC reported at disclosure.

How CVE-2026-53412 works

On July 14, 2026, Zoom published Security Bulletin ZSB-26014 disclosing CVE-2026-53412, a critical (CVSS 3.1 base score 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) improper input validation vulnerability (CWE-20) affecting the Zoom Desktop Client for Windows, the Zoom Workplace VDI Client for Windows, and (per the initial bulletin revision) the Zoom Meeting SDK for Windows. The flaw allows an unauthenticated attacker with only network access to the victim's client to conduct a full account takeover, requiring zero privileges and zero user interaction (AV:N/AC:L/PR:N/UI:N). Zoom's advisory does not disclose the specific vulnerable input handler or protocol, consistent with a vendor choosing not to publish exploitation primitives for an unpatched-in-the-wild population; independent outlets (BleepingComputer, SecurityAffairs, CyberPress, Tenable, SecNews, BetaNews) corroborate the CVSS vector and severity without adding exploit-chain detail beyond 'network-reachable, unauthenticated, no interaction.'

Successful exploitation could grant an attacker access to a victim's archived chat conversations, cloud recording subscriptions, user contact/directory information, meeting history, and account settings, and — because many enterprise Zoom accounts are federated via SSO — potentially provide a foothold into linked corporate identity infrastructure (credential/session exposure risk consistent with T1528 Steal Application Access Token / T1550 Use Alternate Authentication Material patterns, though Zoom has not confirmed the precise mechanism).

Zoom revised the bulletin on July 15, 2026 (revision 1.1) to remove the Meeting SDK for Windows from the list of affected products for CVE-2026-53412 specifically (the SDK remains listed under other CVEs in the same bulletin). The same ZSB-26014 bulletin batch-fixed three related, lower-severity Windows-platform flaws disclosed the same day: CVE-2026-53410 (CVSS 8.8, TOCTOU race condition enabling local privilege escalation during install/uninstall across Zoom Workplace, VDI components, Zoom Rooms, and the Remote Control service), CVE-2026-53409 (CVSS 8.8, improper privilege management in Zoom Rooms for Windows before 7.1.0, authenticated local privilege escalation), and CVE-2026-53411 (CVSS 8.8, input validation flaw in the Zoom Workplace VDI Plugin before 6.6.14, authenticated local privilege escalation). None of the four CVEs in this batch, including CVE-2026-53412, is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of July 16, 2026, and no public proof-of-concept exploit code has surfaced. CVE-2026-53412 was not yet populated in NVD (RESERVED status) at the time of this research, so authoritative CPE/CVSS confirmation relies on the Zoom bulletin and CVSS vector corroborated across independent reporting.

Given the unauthenticated, zero-click, network-vector profile against a ubiquitous enterprise videoconferencing client, this threat warrants urgent patch prioritization even absent confirmed in-the-wild exploitation — the CVSS 9.8 rating and account-takeover impact place it in the same risk tier as historically weaponized unauthenticated RCE/ATO disclosures.

MITRE ATT&CK techniques used in TL-2026-1407

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

Persistence

T1078 Valid Accounts

Discovery

T1082 System Information Discovery; T1087 Account Discovery; T1518 Software Discovery

Collection

T1114 Email Collection; T1213 Data from Information Repositories; T1560 Archive Collected Data

Initial Access

T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

Defense Evasion

T1211 Exploitation for Stealth

Credential Access

T1212 Exploitation for Credential Access; T1528 Steal Application Access Token

Impact

T1531 Account Access Removal

lateral-movement

T1550 Use Alternate Authentication Material

Resource Development

T1588 Obtain Capabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning; T1596 Search Open Technical Databases

Affected products and versions in CVE-2026-53412

  • Zoom — Zoom Workplace for Windows (Desktop Client)
    Vulnerable versions: < 7.0.0
    Fixed in: 7.0.0
  • Zoom — Zoom Workplace VDI Client for Windows
    Vulnerable versions: < 7.0.10; < 6.6.15; < 6.5.18
    Fixed in: 7.0.10; 6.6.15; 6.5.18
  • Zoom — Zoom Meeting SDK for Windows
    Vulnerable versions: < 7.0.0 (listed in initial bulletin, removed from CVE-2026-53412 scope in revision 1.1)
    Fixed in: 7.0.0
  • Zoom — Zoom Rooms for Windows
    Vulnerable versions: < 7.1.0
    Fixed in: 7.1.0
  • Zoom — Zoom Workplace VDI Plugin
    Vulnerable versions: < 6.6.14
    Fixed in: 6.6.14

Remediation for CVE-2026-53412

Patches

  • Zoom Workplace for Windows 7.0.0+
  • Zoom Workplace VDI Client for Windows 7.0.10+ / 6.6.15+ / 6.5.18+
  • Zoom Meeting SDK for Windows 7.0.0+
  • Zoom Rooms for Windows 7.1.0+ (addresses companion CVE-2026-53409)
  • Zoom Workplace VDI Plugin 6.6.14+ (addresses companion CVE-2026-53411)

Immediate actions

  • Upgrade Zoom Workplace for Windows to version 7.0.0 or later on every endpoint
  • Upgrade Zoom Workplace VDI Client for Windows to 7.0.10, 6.6.15, or 6.5.18 (or later within the respective branch)
  • Upgrade Zoom Meeting SDK for Windows to 7.0.0 or later where embedded in custom applications
  • Inventory all Windows endpoints and VDI golden images running Zoom clients to confirm patched version alignment
  • Restrict/monitor unauthenticated inbound network access to hosts running vulnerable Zoom client versions where immediate patching is not possible

Workarounds

  • No official workaround published by Zoom; immediate upgrade to the fixed version is the only vendor-endorsed remediation

Longer-term hardening

  • Deploy centralized/managed Zoom client update policies (e.g., via SCCM/Intune) so future Zoom security bulletins are remediated within a defined SLA
  • Enforce SSO session revocation and re-authentication procedures for accounts that may have been exposed prior to patching
  • Monitor Zoom account activity logs for anomalous session creation, settings changes, or contact/chat exfiltration indicative of account takeover
  • Include Zoom client version compliance in vulnerability management and endpoint compliance dashboards

CVEs associated with CVE-2026-53412

CVE-2026-53412, CVE-2026-53410, CVE-2026-53409, CVE-2026-53411

Weaknesses (CWE) in CVE-2026-53412

CWE-20, CWE-367, CWE-269

Timeline of CVE-2026-53412

  • BleepingComputer, secnews.gr, and securityonline.info publish independent coverage corroborating the CVSS 9.8 rating and unauthenticated network attack vector.
  • cybersecuritynews.com publishes the first third-party report on the Zoom Desktop Client Windows flaw.
  • Zoom publishes Security Bulletin ZSB-26014 disclosing CVE-2026-53412 (CVSS 9.8) along with companion CVEs CVE-2026-53410, CVE-2026-53409, and CVE-2026-53411, and releases patched versions.
  • Zoom's internal Offensive Security team identifies CVE-2026-53412 during proactive security testing of the Windows Desktop Client, VDI Client, and Meeting SDK.
  • Tenable publishes a CVE tracking page for CVE-2026-53412 confirming the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector.
  • SecurityAffairs, BetaNews, and CyberPress publish follow-up analysis, noting the batch-fix of three additional privilege-escalation CVEs in the same bulletin.
  • Zoom issues revision 1.1 of ZSB-26014, removing Zoom Meeting SDK for Windows from the affected-product list specifically for CVE-2026-53412.
  • TL-Intel Harness completes threat intelligence research and documentation for TL-2026-1407 / CVE-2026-53412.
  • CVE-2026-53412 remains in RESERVED status in the National Vulnerability Database, with authoritative technical detail available only via the Zoom vendor bulletin and independent reporting.
  • CVE-2026-53412 confirmed absent from the CISA Known Exploited Vulnerabilities catalog; no active exploitation or public PoC identified.

Sources cited for CVE-2026-53412

Threats related to CVE-2026-53412

Detection coverage for TL-2026-1407

As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1407 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats