# CVE-2026-53412: Unauthenticated Remote Account Takeover in Zoom Desktop Client, VDI Client, and Meeting SDK for Windows

> Zoom disclosed CVE-2026-53412 (CVSS 9.8), an improper input validation flaw in Zoom Workplace for Windows, the Zoom Workplace VDI Client for Windows, and Zoom Meeting SDK for Windows that allows an unauthenticated remote attacker to take over a user's Zoom account over the network without any victim interaction. Fixed in Zoom Workplace 7.0.0+, VDI Client 7.0.10/6.6.15/6.5.18+, and Meeting SDK 7.0.0+; discovered internally by Zoom's Offensive Security team with no active exploitation or public PoC reported at disclosure.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1407
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-zoom-zsb-26014-vdi-account-takeover-tl-2026-1407.webp?v=c52bb28e (Threadlinqs threat intel: CVE-2026-53412 Zoom Account Hijack: Detection & IOCs (TL-2026-1407) — Critical severity, 18 IOCs, 9 detection rules.)
- **ID:** TL-2026-1407
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 18
- **CVEs:** CVE-2026-53412, CVE-2026-53410, CVE-2026-53409, CVE-2026-53411

## Description

On July 14, 2026, Zoom published Security Bulletin ZSB-26014 disclosing CVE-2026-53412, a critical (CVSS 3.1 base score 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) improper input validation vulnerability (CWE-20) affecting the Zoom Desktop Client for Windows, the Zoom Workplace VDI Client for Windows, and (per the initial bulletin revision) the Zoom Meeting SDK for Windows. The flaw allows an unauthenticated attacker with only network access to the victim's client to conduct a full account takeover, requiring zero privileges and zero user interaction (AV:N/AC:L/PR:N/UI:N). Zoom's advisory does not disclose the specific vulnerable input handler or protocol, consistent with a vendor choosing not to publish exploitation primitives for an unpatched-in-the-wild population; independent outlets (BleepingComputer, SecurityAffairs, CyberPress, Tenable, SecNews, BetaNews) corroborate the CVSS vector and severity without adding exploit-chain detail beyond 'network-reachable, unauthenticated, no interaction.'

Successful exploitation could grant an attacker access to a victim's archived chat conversations, cloud recording subscriptions, user contact/directory information, meeting history, and account settings, and — because many enterprise Zoom accounts are federated via SSO — potentially provide a foothold into linked corporate identity infrastructure (credential/session exposure risk consistent with T1528 Steal Application Access Token / T1550 Use Alternate Authentication Material patterns, though Zoom has not confirmed the precise mechanism).

Zoom revised the bulletin on July 15, 2026 (revision 1.1) to remove the Meeting SDK for Windows from the list of affected products for CVE-2026-53412 specifically (the SDK remains listed under other CVEs in the same bulletin). The same ZSB-26014 bulletin batch-fixed three related, lower-severity Windows-platform flaws disclosed the same day: CVE-2026-53410 (CVSS 8.8, TOCTOU race condition enabling local privilege escalation during install/uninstall across Zoom Workplace, VDI components, Zoom Rooms, and the Remote Control service), CVE-2026-53409 (CVSS 8.8, improper privilege management in Zoom Rooms for Windows before 7.1.0, authenticated local privilege escalation), and CVE-2026-53411 (CVSS 8.8, input validation flaw in the Zoom Workplace VDI Plugin before 6.6.14, authenticated local privilege escalation). None of the four CVEs in this batch, including CVE-2026-53412, is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of July 16, 2026, and no public proof-of-concept exploit code has surfaced. CVE-2026-53412 was not yet populated in NVD (RESERVED status) at the time of this research, so authoritative CPE/CVSS confirmation relies on the Zoom bulletin and CVSS vector corroborated across independent reporting.

Given the unauthenticated, zero-click, network-vector profile against a ubiquitous enterprise videoconferencing client, this threat warrants urgent patch prioritization even absent confirmed in-the-wild exploitation — the CVSS 9.8 rating and account-takeover impact place it in the same risk tier as historically weaponized unauthenticated RCE/ATO disclosures.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1528 Steal Application Access Token
- T1550 Use Alternate Authentication Material
- T1212 Exploitation for Credential Access
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1211 Exploitation for Stealth
- T1087 Account Discovery
- T1213 Data from Information Repositories
- T1560 Archive Collected Data
- T1531 Account Access Removal
- T1078 Valid Accounts
- T1596 Search Open Technical Databases
- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1588 Obtain Capabilities
- T1082 System Information Discovery
- T1518 Software Discovery
- T1114 Email Collection

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Unauthenticated Inbound Connection to Zoom Client Process (CVE-2026-53412 Exploitation)** (`TL-2026-1407-SPL-001`)

Detects an unsolicited inbound network connection to a Zoom Workplace / VDI Client / Meeting SDK process (Zoom.exe, CptHost.exe) that is not preceded by a normal outbound meeting-join request — the network-reachable, unauthenticated, zero-click exploitation pattern for CVE-2026-53412 (CVSS 9.8).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| where match(Image, "(?i)\\\\(Zoom\.exe|CptHost\.exe)$")
| where Initiated="false"
| eval dest_range=if(cidrmatch("3.0.0.0/8", DestinationIp) OR cidrmatch("170.114.0.0/16", DestinationIp), "known_zoom_infra", "unknown")
| where dest_range="unknown"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer, User, Image, SourceIp, DestinationIp, DestinationPort
| where count > 0
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| table Computer, User, Image, SourceIp, DestinationIp, DestinationPort, count, first_seen, last_seen
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("Zoom.exe", "CptHost.exe")
| where ActionType == "InboundConnectionAccepted" or (ActionType == "ConnectionSuccess" and LocalIPType == "Public")
| where not(ipv4_is_match(RemoteIP, "3.0.0.0/8")) and not(ipv4_is_match(RemoteIP, "170.114.0.0/16"))
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, LocalIP, LocalPort, RemoteIP, RemotePort
| summarize ConnectionCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, AccountName, InitiatingProcessFileName, RemoteIP
| where ConnectionCount > 0
```

### Sigma

```yaml
title: Unauthenticated Inbound Connection to Zoom Client Process (CVE-2026-53412)
id: 8a2e7c10-53a4-4c11-8f0d-tlintel1407001
status: experimental
description: Detects an unsolicited inbound network connection to a Zoom client process (Zoom.exe/CptHost.exe) not originating from known Zoom cloud infrastructure, consistent with unauthenticated exploitation of CVE-2026-53412.
references:
    - https://www.zoom.com/en/trust/security-bulletin/ZSB-26014/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-53412
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-16
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026.53412
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith:
            - '\Zoom.exe'
            - '\CptHost.exe'
        Initiated: 'false'
    filter_known_zoom_infra:
        DestinationIp|cidr:
            - '3.0.0.0/8'
            - '170.114.0.0/16'
    condition: selection and not filter_known_zoom_infra
falsepositives:
    - Legitimate inbound meeting-join or SDK callback traffic from expected Zoom cloud IP ranges
    - NAT/firewall misclassification of connection direction
level: high
```

**Known false positives:**

- Legitimate inbound meeting-join or SDK callback traffic from expected Zoom cloud IP ranges not yet allow-listed
- NAT/proxy configurations that misreport connection direction

**Tuning notes:** Maintain and periodically refresh the Zoom cloud IP allow-list (Zoom publishes network ranges); narrow to hosts confirmed to run pre-7.0.0 Zoom Workplace/VDI Client builds to reduce noise until patch rollout completes.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Zoom Client Unauthenticated Inbound Exploitation Attempt (CVE-2026-53412) (locked: unlock with TL Creds)
- Non-Elevated Process Writing to Path Consumed by SYSTEM Zoom Install/Uninstall Service (CVE-2026-53410) (locked: unlock with TL Creds)
- Post-ATO Contact/Chat/Recording Enumeration and Archive Staging (Data from Information Repositories) (locked: unlock with TL Creds)
- Zoom Client Zero-Click Network Exploitation Indicator (CVE-2026-53412) (locked: unlock with TL Creds)
- Zoom Installer TOCTOU Registry/Temp Persistence Artifact (CVE-2026-53410) (locked: unlock with TL Creds)
- Account Access Removal Following Anomalous Zoom Session Activity (Impact of ATO) (locked: unlock with TL Creds)
- Zoom Installer/Uninstaller TOCTOU Temp-File Race (CVE-2026-53410 Post-Exploitation) (locked: unlock with TL Creds)
- Post-Account-Takeover Session/Token Artifact Write and SSO Anomaly Correlation (CVE-2026-53412 C2/Lateral Movement) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Zoom Security Bulletin ZSB-26014](https://www.zoom.com/en/trust/security-bulletin/ZSB-26014/)
- [Zoom desktop client Windows flaw allows account takeover](https://cybersecuritynews.com/zoom-desktop-client-windows-flaw/)
- [Zoom warns of critical account takeover vulnerability](https://www.bleepingcomputer.com/news/security/zoom-warns-of-critical-account-takeover-vulnerability/)
- [CVE-2026-53412: CVSS 9.8 Zoom Vulnerability Allows Unauthenticated Account Takeover](https://securityonline.info/zoom-account-takeover-flaw/)
- [Zoom Account Takeover: CVE-2026-53412 CVSS 9.8](https://www.secnews.gr/en/721706/zoom-account-takeover-cve-2026-53412-windows/)
- [Zoom Fixes CVE-2026-53412, a Critical Account Takeover Bug](https://securityaffairs.com/195454/security/zoom-fixes-cve-2026-53412-a-critical-account-takeover-bug.html)
- [Zoom issues a warning to Windows users about critical security flaw](https://betanews.com/article/zoom-issues-a-warning-to-windows-users-about-critical-security-flaw/)
- [CVE-2026-53412](https://www.tenable.com/cve/CVE-2026-53412)
- [CVE-2026-53412 Record](https://www.cve.org/CVERecord?id=CVE-2026-53412)
- [NVD Detail: CVE-2026-53412 (RESERVED at time of research)](https://nvd.nist.gov/vuln/detail/CVE-2026-53412)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [Zoom Workplace for Windows Vulnerability Allows Users to Escalate Privileges](https://cyberpress.org/zoom-workplace-for-windows-vulnerability/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1407