CVE-2026-53412: Unauthenticated Remote Account Takeover in Zoom Desktop Client, VDI Client, and Meeting SDK for Windows

Key facts for Zoom ZSB-26014 VDI account takeover

Detection coverage for Zoom ZSB-26014 VDI account takeover

As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1407 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Unauthenticated Inbound Connection to Zoom Client Process (CVE-2026-53412 Exploitation)

Detects an unsolicited inbound network connection to a Zoom Workplace / VDI Client / Meeting SDK process (Zoom.exe, CptHost.exe) that is not preceded by a normal outbound meeting-join request — the network-reachable, unauthenticated, zero-click exploitation pattern for CVE-2026-53412 (CVSS 9.8).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| where match(Image, "(?i)\\\\(Zoom\.exe|CptHost\.exe)$")
| where Initiated="false"
| eval dest_range=if(cidrmatch("3.0.0.0/8", DestinationIp) OR cidrmatch("170.114.0.0/16", DestinationIp), "known_zoom_infra", "unknown")
| where dest_range="unknown"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer, User, Image, SourceIp, DestinationIp, DestinationPort
| where count > 0
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| table Computer, User, Image, SourceIp, DestinationIp, DestinationPort, count, first_seen, last_seen

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("Zoom.exe", "CptHost.exe")
| where ActionType == "InboundConnectionAccepted" or (ActionType == "ConnectionSuccess" and LocalIPType == "Public")
| where not(ipv4_is_match(RemoteIP, "3.0.0.0/8")) and not(ipv4_is_match(RemoteIP, "170.114.0.0/16"))
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, LocalIP, LocalPort, RemoteIP, RemotePort
| summarize ConnectionCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, AccountName, InitiatingProcessFileName, RemoteIP
| where ConnectionCount > 0

Sigma

title: Unauthenticated Inbound Connection to Zoom Client Process (CVE-2026-53412)
id: 8a2e7c10-53a4-4c11-8f0d-tlintel1407001
status: experimental
description: Detects an unsolicited inbound network connection to a Zoom client process (Zoom.exe/CptHost.exe) not originating from known Zoom cloud infrastructure, consistent with unauthenticated exploitation of CVE-2026-53412.
references:
    - https://www.zoom.com/en/trust/security-bulletin/ZSB-26014/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-53412
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-16
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026.53412
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith:
            - '\Zoom.exe'
            - '\CptHost.exe'
        Initiated: 'false'
    filter_known_zoom_infra:
        DestinationIp|cidr:
            - '3.0.0.0/8'
            - '170.114.0.0/16'
    condition: selection and not filter_known_zoom_infra
falsepositives:
    - Legitimate inbound meeting-join or SDK callback traffic from expected Zoom cloud IP ranges
    - NAT/firewall misclassification of connection direction
level: high

Known false positives:

• Legitimate inbound meeting-join or SDK callback traffic from expected Zoom cloud IP ranges not yet allow-listed
• NAT/proxy configurations that misreport connection direction

Tuning notes: Maintain and periodically refresh the Zoom cloud IP allow-list (Zoom publishes network ranges); narrow to hosts confirmed to run pre-7.0.0 Zoom Workplace/VDI Client builds to reduce noise until patch rollout completes.

• 🔒 Zoom Client Unauthenticated Inbound Exploitation Attempt (CVE-2026-53412) · unlock with TL Creds
• 🔒 Non-Elevated Process Writing to Path Consumed by SYSTEM Zoom Install/Uninstall Service (CVE-2026-53410) · unlock with TL Creds
• 🔒 Post-ATO Contact/Chat/Recording Enumeration and Archive Staging (Data from Information Repositories) · unlock with TL Creds
• 🔒 Zoom Client Zero-Click Network Exploitation Indicator (CVE-2026-53412) · unlock with TL Creds
• 🔒 Zoom Installer TOCTOU Registry/Temp Persistence Artifact (CVE-2026-53410) · unlock with TL Creds
• 🔒 Account Access Removal Following Anomalous Zoom Session Activity (Impact of ATO) · unlock with TL Creds
• 🔒 Zoom Installer/Uninstaller TOCTOU Temp-File Race (CVE-2026-53410 Post-Exploitation) · unlock with TL Creds
• 🔒 Post-Account-Takeover Session/Token Artifact Write and SSO Anomaly Correlation (CVE-2026-53412 C2/Lateral Movement) · unlock with TL Creds

Indicators of compromise for Zoom ZSB-26014 VDI account takeover

As of 2026-07-16, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-1407.

How Zoom ZSB-26014 VDI account takeover works

Fixed in Zoom Workplace 7.0.0+, VDI Client 7.0.10/6.6.15/6.5.18+, and Meeting SDK 7.0.0+; discovered internally by Zoom's Offensive Security team with no active exploitation or public PoC reported at disclosure.

On July 14, 2026, Zoom published Security Bulletin ZSB-26014 disclosing CVE-2026-53412, a critical (CVSS 3.1 base score 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) improper input validation vulnerability (CWE-20) affecting the Zoom Desktop Client for Windows, the Zoom Workplace VDI Client for Windows, and (per the initial bulletin revision) the Zoom Meeting SDK for Windows. The flaw allows an unauthenticated attacker with only network access to the victim's client to conduct a full account takeover, requiring zero privileges and zero user interaction (AV:N/AC:L/PR:N/UI:N). Zoom's advisory does not disclose the specific vulnerable input handler or protocol, consistent with a vendor choosing not to publish exploitation primitives for an unpatched-in-the-wild population; independent outlets (BleepingComputer, SecurityAffairs, CyberPress, Tenable, SecNews, BetaNews) corroborate the CVSS vector and severity without adding exploit-chain detail beyond 'network-reachable, unauthenticated, no interaction.'

Successful exploitation could grant an attacker access to a victim's archived chat conversations, cloud recording subscriptions, user contact/directory information, meeting history, and account settings, and — because many enterprise Zoom accounts are federated via SSO — potentially provide a foothold into linked corporate identity infrastructure (credential/session exposure risk consistent with T1528 Steal Application Access Token / T1550 Use Alternate Authentication Material patterns, though Zoom has not confirmed the precise mechanism).

Zoom revised the bulletin on July 15, 2026 (revision 1.1) to remove the Meeting SDK for Windows from the list of affected products for CVE-2026-53412 specifically (the SDK remains listed under other CVEs in the same bulletin). The same ZSB-26014 bulletin batch-fixed three related, lower-severity Windows-platform flaws disclosed the same day: CVE-2026-53410 (CVSS 8.8, TOCTOU race condition enabling local privilege escalation during install/uninstall across Zoom Workplace, VDI components, Zoom Rooms, and the Remote Control service), CVE-2026-53409 (CVSS 8.8, improper privilege management in Zoom Rooms for Windows before 7.1.0, authenticated local privilege escalation), and CVE-2026-53411 (CVSS 8.8, input validation flaw in the Zoom Workplace VDI Plugin before 6.6.14, authenticated local privilege escalation). None of the four CVEs in this batch, including CVE-2026-53412, is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of July 16, 2026, and no public proof-of-concept exploit code has surfaced. CVE-2026-53412 was not yet populated in NVD (RESERVED status) at the time of this research, so authoritative CPE/CVSS confirmation relies on the Zoom bulletin and CVSS vector corroborated across independent reporting.

Given the unauthenticated, zero-click, network-vector profile against a ubiquitous enterprise videoconferencing client, this threat warrants urgent patch prioritization even absent confirmed in-the-wild exploitation — the CVSS 9.8 rating and account-takeover impact place it in the same risk tier as historically weaponized unauthenticated RCE/ATO disclosures.

MITRE ATT&CK techniques by tactic:

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

Persistence

T1078 Valid Accounts

Discovery

T1082 System Information Discovery; T1087 Account Discovery; T1518 Software Discovery

Collection

T1114 Email Collection; T1213 Data from Information Repositories; T1560 Archive Collected Data

Initial Access

T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

Defense Evasion

T1211 Exploitation for Stealth

Credential Access

T1212 Exploitation for Credential Access; T1528 Steal Application Access Token

Impact

T1531 Account Access Removal

lateral-movement

T1550 Use Alternate Authentication Material

Resource Development

T1588 Obtain Capabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning; T1596 Search Open Technical Databases

Remediation for Zoom ZSB-26014 VDI account takeover

Patches

• Zoom Workplace for Windows 7.0.0+
• Zoom Workplace VDI Client for Windows 7.0.10+ / 6.6.15+ / 6.5.18+
• Zoom Meeting SDK for Windows 7.0.0+
• Zoom Rooms for Windows 7.1.0+ (addresses companion CVE-2026-53409)
• Zoom Workplace VDI Plugin 6.6.14+ (addresses companion CVE-2026-53411)

Immediate actions

• Upgrade Zoom Workplace for Windows to version 7.0.0 or later on every endpoint
• Upgrade Zoom Workplace VDI Client for Windows to 7.0.10, 6.6.15, or 6.5.18 (or later within the respective branch)
• Upgrade Zoom Meeting SDK for Windows to 7.0.0 or later where embedded in custom applications
• Inventory all Windows endpoints and VDI golden images running Zoom clients to confirm patched version alignment
• Restrict/monitor unauthenticated inbound network access to hosts running vulnerable Zoom client versions where immediate patching is not possible

Workarounds

• No official workaround published by Zoom; immediate upgrade to the fixed version is the only vendor-endorsed remediation

Longer-term hardening

• Deploy centralized/managed Zoom client update policies (e.g., via SCCM/Intune) so future Zoom security bulletins are remediated within a defined SLA
• Enforce SSO session revocation and re-authentication procedures for accounts that may have been exposed prior to patching
• Monitor Zoom account activity logs for anomalous session creation, settings changes, or contact/chat exfiltration indicative of account takeover
• Include Zoom client version compliance in vulnerability management and endpoint compliance dashboards

Affected and fixed versions

• Zoom — Zoom Workplace for Windows (Desktop Client)
  Vulnerable versions: < 7.0.0
  Fixed in: 7.0.0
• Zoom — Zoom Workplace VDI Client for Windows
  Vulnerable versions: < 7.0.10; < 6.6.15; < 6.5.18
  Fixed in: 7.0.10; 6.6.15; 6.5.18
• Zoom — Zoom Meeting SDK for Windows
  Vulnerable versions: < 7.0.0 (listed in initial bulletin, removed from CVE-2026-53412 scope in revision 1.1)
  Fixed in: 7.0.0
• Zoom — Zoom Rooms for Windows
  Vulnerable versions: < 7.1.0
  Fixed in: 7.1.0
• Zoom — Zoom Workplace VDI Plugin
  Vulnerable versions: < 6.6.14
  Fixed in: 6.6.14

Timeline of Zoom ZSB-26014 VDI account takeover

• 2026-07-14 BleepingComputer, secnews.gr, and securityonline.info publish independent coverage corroborating the CVSS 9.8 rating and unauthenticated network attack vector.
• 2026-07-14 cybersecuritynews.com publishes the first third-party report on the Zoom Desktop Client Windows flaw.
• 2026-07-14 Zoom publishes Security Bulletin ZSB-26014 disclosing CVE-2026-53412 (CVSS 9.8) along with companion CVEs CVE-2026-53410, CVE-2026-53409, and CVE-2026-53411, and releases patched versions.
• 2026-07-14 Zoom's internal Offensive Security team identifies CVE-2026-53412 during proactive security testing of the Windows Desktop Client, VDI Client, and Meeting SDK.
• 2026-07-15 Tenable publishes a CVE tracking page for CVE-2026-53412 confirming the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector.
• 2026-07-15 SecurityAffairs, BetaNews, and CyberPress publish follow-up analysis, noting the batch-fix of three additional privilege-escalation CVEs in the same bulletin.
• 2026-07-15 Zoom issues revision 1.1 of ZSB-26014, removing locked-ioc-4 from the affected-product list specifically for CVE-2026-53412.
• 2026-07-16 TL-Intel Harness completes threat intelligence research and documentation for TL-2026-1407 / CVE-2026-53412.
• 2026-07-16 CVE-2026-53412 remains in RESERVED status in the National Vulnerability Database, with authoritative technical detail available only via the Zoom vendor bulletin and independent reporting.
• 2026-07-16 CVE-2026-53412 confirmed absent from the CISA Known Exploited Vulnerabilities catalog; no active exploitation or public PoC identified.

Sources cited for Zoom ZSB-26014 VDI account takeover

• CVE-2026-53412 Record CVE Program · Advisory · 2026-07-14
• NVD Detail: CVE-2026-53412 (RESERVED at time of research) NVD (NIST) · Advisory · 2026-07-16
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-07-15
• Zoom Security Bulletin ZSB-26014 zoom.com · Vendor report · 2026-07-14
• CVE-2026-53412 Tenable · Vendor report · 2026-07-15
• CVE-2026-53412: CVSS 9.8 Zoom Vulnerability Allows Unauthenticated Account Takeover securityonline.info · Blog · 2026-07-14
• Zoom desktop client Windows flaw allows account takeover cybersecuritynews.com · News · 2026-07-14
• Zoom warns of critical account takeover vulnerability BleepingComputer · News · 2026-07-14
• Zoom Account Takeover: CVE-2026-53412 CVSS 9.8 secnews.gr · News · 2026-07-14
• Zoom Fixes CVE-2026-53412, a Critical Account Takeover Bug securityaffairs.com · News · 2026-07-15
• Zoom issues a warning to Windows users about critical security flaw betanews.com · News · 2026-07-15
• Zoom Workplace for Windows Vulnerability Allows Users to Escalate Privileges cyberpress.org · News · 2026-07-15

Threats related to Zoom ZSB-26014 VDI account takeover

• RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition Local Privilege Escalation (CVE-2026-64600)

Previous and next in vulnerability

• Multiple Splunk Enterprise Vulnerabilities Enable Path Traversal and Information Disclosure (CVE-2026-20296, CVE-2026-20297, CVE-2026-20298) Next report