# Zoom Clients Certificate Validation Flaws (CVE-2026-108184, CVE-2026-108185) Expose Sensitive Information via Network Access

> Two improper certificate validation vulnerabilities in Zoom clients (ZSB-26021 for Zoom Workplace, Workplace VDI Client and Rooms on Windows; ZSB-26022 for the My Notes feature across Workplace platforms) may allow an unauthenticated network attacker to disclose sensitive information. Both are rated CVSS 7.4 and were fixed in Zoom 7.2.0 / 7.1.9 (product- and branch-dependent); no exploitation was identified.

- **Published:** 2026-10-13T16:30:08Z
- **Last reviewed:** 2026-10-13T16:30:08Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3424
- **ID:** TL-2026-3424
- **Severity:** HIGH (CVSS 7.4)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-108184, CVE-2026-108185

## Description

On 2026-10-13 Zoom published two security bulletins, both internally reported by Zoom Offensive Security. ZSB-26021 (CVE-2026-108184) describes improper certificate validation in certain Zoom clients for Windows that may allow an unauthenticated user to conduct an information disclosure via network access. Affected builds are Zoom Workplace for Windows 7.0.0 up to (but excluding) 7.2.0 and 7.1.9, Zoom Workplace VDI Client for Windows 7.0.11 up to 7.0.13, and Zoom Rooms for Windows 7.0.0 up to 7.1.7.

ZSB-26022 (CVE-2026-108185) describes improper certificate validation in the My Notes feature of certain Zoom clients, with the same impact. Affected builds are Windows 7.1.5 to before 7.2.0/7.1.9, macOS and Linux 7.0.5 to before 7.2.0/7.1.9, and Android and iOS 7.0.5 to before 7.2.0.

Both issues carry the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (7.4 HIGH). NVD classifies CVE-2026-108184 as CWE-295 (Improper Certificate Validation). The high attack complexity reflects the typical need for an on-path network position. The bulletins do not state which data is exposed, the exact validation failure, or any exploitation technique. Analyst note: the MITRE ATT&CK mappings below are inferred from the vulnerability class (CWE-295 with network attack vector and high confidentiality/integrity impact), not from described attacker activity. The source reports no confirmed exploitation, no public PoC, and no network or file indicators. The IOC entries record vulnerable-version indicators for exposure hunting. Remediation is to update to the fixed versions listed in the bulletins. Zoom previously published similar certificate validation bulletins: ZSB-25023 (CVE-2025-46788, 2025-07-08, Workplace and Meeting SDK for Linux, CVSS 7.4, also found by Zoom Offensive Security) and ZSB-25044 (CVE-2025-30669, 2025-11-11, CVSS 4.8 with adjacent-network vector, reported by shmoul). The bulletins themselves do not state a CWE; CWE-295 comes from the NVD record for CVE-2026-108184 (NVD status Received at publication). At collection time, NVD data was available only for CVE-2026-108184.

## MITRE ATT&CK

- T1557 Adversary-in-the-Middle
- T1557 Adversary-in-the-Middle
- T1040 Network Sniffing
- T1040 Network Sniffing
- T1565.002 Transmitted Data Manipulation
- T1638 Adversary-in-the-Middle

## Sources

- [Zoom Security Bulletin ZSB-26021 (CVE-2026-108184)](https://www.zoom.com/en/trust/security-bulletin/zsb-26021/)
- [Zoom Security Bulletin ZSB-26022 (CVE-2026-108185)](https://www.zoom.com/en/trust/security-bulletin/zsb-26022/)
- [NVD - CVE-2026-108184](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-108184)
- [Zoom Clients for Certificate Validation Flaw Exposes Sensitive Information via Network Access](https://cybersecuritynews.com/zoom-certificate-validation-flaw/)
- [Zoom Security Bulletins index](https://www.zoom.com/en/trust/security-bulletin/)
- [Zoom Download Center (fixed client builds)](https://zoom.us/download)
- [Prior Zoom bulletin ZSB-25044: Zoom Workplace Clients - Improper Certificate Validation](https://www.zoom.com/en/trust/security-bulletin/zsb-25044/)
- [Prior Zoom bulletin ZSB-25023: Zoom Workplace for Linux - Improper Certificate Validation](https://www.zoom.com/en/trust/security-bulletin/ZSB-25023)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3424