Threat reportVulnerabilityTL-2026-3424
Zoom Clients Certificate Validation Flaws (CVE-2026-108184, CVE-2026-108185) Expose Sensitive Information via Network Access
Zoom Clients Certificate Validation Flaws (CVE-2026-108184 (TL-2026-3424), also tracked as ZSB-26021, is a high-severity software vulnerability scored CVSS 7.4, first published 2026-10-13. It has no confirmed attribution, affects Zoom Zoom Workplace for Windows, references 2 CVEs (CVE-2026-108184, CVE-2026-108185), maps to 4 MITRE ATT&CK techniques (T1040, T1557, T1565.002), and is covered by 9 detection rules and 11 indicators of compromise.
- CVSS
- 7.4/10High
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-3424
- Threat ID
- TL-2026-3424
- Also known as
- ZSB-26021, ZSB-26022
- Severity
- HIGH
- CVSS
- 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, health, education, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 11
How Zoom Clients Certificate Validation Flaws (CVE-2026-108184 works
Two improper certificate validation vulnerabilities in Zoom clients (ZSB-26021 for Zoom Workplace, Workplace VDI Client and Rooms on Windows; ZSB-26022 for the My Notes feature across Workplace platforms) may allow an unauthenticated network attacker to disclose sensitive information. Both are rated CVSS 7.4 and were fixed in Zoom 7.2.0 / 7.1.9 (product- and branch-dependent); no exploitation was identified.
On 2026-10-13 Zoom published two security bulletins, both internally reported by Zoom Offensive Security. ZSB-26021 (CVE-2026-108184) describes improper certificate validation in certain Zoom clients for Windows that may allow an unauthenticated user to conduct an information disclosure via network access. Affected builds are Zoom Workplace for Windows 7.0.0 up to (but excluding) 7.2.0 and 7.1.9, Zoom Workplace VDI Client for Windows 7.0.11 up to 7.0.13, and Zoom Rooms for Windows 7.0.0 up to 7.1.7.
ZSB-26022 (CVE-2026-108185) describes improper certificate validation in the My Notes feature of certain Zoom clients, with the same impact. Affected builds are Windows 7.1.5 to before 7.2.0/7.1.9, macOS and Linux 7.0.5 to before 7.2.0/7.1.9, and Android and iOS 7.0.5 to before 7.2.0.
Both issues carry the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (7.4 HIGH). NVD classifies CVE-2026-108184 as CWE-295 (Improper Certificate Validation). The high attack complexity reflects the typical need for an on-path network position. The bulletins do not state which data is exposed, the exact validation failure, or any exploitation technique. Analyst note: the MITRE ATT&CK mappings below are inferred from the vulnerability class (CWE-295 with network attack vector and high confidentiality/integrity impact), not from described attacker activity. The source reports no confirmed exploitation, no public PoC, and no network or file indicators. The IOC entries record vulnerable-version indicators for exposure hunting. Remediation is to update to the fixed versions listed in the bulletins. Zoom previously published similar certificate validation bulletins: ZSB-25023 (CVE-2025-46788, 2025-07-08, Workplace and Meeting SDK for Linux, CVSS 7.4, also found by Zoom Offensive Security) and ZSB-25044 (CVE-2025-30669, 2025-11-11, CVSS 4.8 with adjacent-network vector, reported by shmoul). The bulletins themselves do not state a CWE; CWE-295 comes from the NVD record for CVE-2026-108184 (NVD status Received at publication). At collection time, NVD data was available only for CVE-2026-108184.
MITRE ATT&CK techniques used in TL-2026-3424
Credential Access
T1040 Network Sniffing; T1557 Adversary-in-the-Middle
Discovery
Collection
Impact
T1565.002 Transmitted Data Manipulation
collection
Affected products and versions in Zoom Clients Certificate Validation Flaws (CVE-2026-108184
- Zoom — Zoom Workplace for Windows
Vulnerable versions: 7.0.0 to before 7.2.0; 7.0.0 to before 7.1.9
Fixed in: 7.2.0; 7.1.9 - Zoom — Zoom Workplace VDI Client for Windows
Vulnerable versions: 7.0.11 to before 7.0.13
Fixed in: 7.0.13 - Zoom — Zoom Rooms for Windows
Vulnerable versions: 7.0.0 to before 7.1.7
Fixed in: 7.1.7 - Zoom — Zoom Workplace My Notes (Windows)
Vulnerable versions: 7.1.5 to before 7.2.0; 7.1.5 to before 7.1.9
Fixed in: 7.2.0; 7.1.9 - Zoom — Zoom Workplace My Notes (macOS, Linux)
Vulnerable versions: 7.0.5 to before 7.2.0; 7.0.5 to before 7.1.9
Fixed in: 7.2.0; 7.1.9 - Zoom — Zoom Workplace My Notes (Android, iOS)
Vulnerable versions: 7.0.5 to before 7.2.0
Fixed in: 7.2.0
Remediation for Zoom Clients Certificate Validation Flaws (CVE-2026-108184
Patches
- ZSB-26021 / CVE-2026-108184: Zoom Workplace for Windows 7.2.0 or 7.1.9; Workplace VDI Client for Windows 7.0.13; Zoom Rooms for Windows 7.1.7
- ZSB-26022 / CVE-2026-108185: Zoom Workplace (Windows, macOS, Linux) 7.2.0 or 7.1.9; Android and iOS 7.2.0
Immediate actions
- Inventory Zoom Workplace, Workplace VDI Client and Zoom Rooms deployments and identify builds in the affected ranges
- Prioritize updating clients that connect over untrusted or shared networks (remote workers, kiosks, conference rooms)
Workarounds
- No vendor workaround published; avoid Zoom sessions on untrusted networks until clients are updated
Longer-term hardening
- Enforce managed, automatic client updates for Zoom across Windows, macOS, Linux, Android and iOS
- Monitor for TLS interception or unexpected certificate chains on traffic from Zoom clients
CVEs associated with Zoom Clients Certificate Validation Flaws (CVE-2026-108184
Weaknesses (CWE) in Zoom Clients Certificate Validation Flaws (CVE-2026-108184
Timeline of Zoom Clients Certificate Validation Flaws (CVE-2026-108184
- Zoom publishes ZSB-25023 (CVE-2025-46788, CVSS 7.4, same vector) for improper certificate validation in Zoom Workplace and Meeting SDK for Linux before 6.4.13, also reported by Zoom Offensive Security; an earlier instance of the same bug class.
- Zoom publishes ZSB-25044 (CVE-2025-30669, CVSS 4.8) for improper certificate validation in Workplace, VDI Client and Meeting SDK clients before 6.5.10, reported externally by shmoul.
- Cyber Security News reports on both flaws; no confirmed exploitation, public PoC or indicators are stated.
- Fixed builds released: Workplace 7.2.0/7.1.9, Workplace VDI Client 7.0.13, Zoom Rooms 7.1.7, and My Notes fixes in 7.2.0/7.1.9 (mobile 7.2.0).
- CVE-2026-108184 is published in NVD at 15:17 UTC (status Received, source security@zoom.us) with CVSS 3.1 base score 7.4 (HIGH), CWE-295, exploitability subscore 2.2 and impact subscore 5.2.
- Zoom publishes ZSB-26022 (CVE-2026-108185) covering improper certificate validation in the My Notes feature of Zoom Workplace across Windows, macOS, Linux, Android and iOS.
- Zoom publishes ZSB-26021 (CVE-2026-108184) covering improper certificate validation in Zoom Workplace, Workplace VDI Client and Rooms for Windows.
Sources cited for Zoom Clients Certificate Validation Flaws (CVE-2026-108184
- Zoom Security Bulletin ZSB-26021 (CVE-2026-108184)
- Zoom Security Bulletin ZSB-26022 (CVE-2026-108185)
- NVD - CVE-2026-108184
- Zoom Clients for Certificate Validation Flaw Exposes Sensitive Information via Network Access
- Zoom Security Bulletins index
- Zoom Download Center (fixed client builds)
- Prior Zoom bulletin ZSB-25044: Zoom Workplace Clients - Improper Certificate Validation
- Prior Zoom bulletin ZSB-25023: Zoom Workplace for Linux - Improper Certificate Validation
Detection coverage for TL-2026-3424
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3424 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.