Critical severity · published Jul 16, 2026
CVE-2026-53412
Zoom Workplace VDI Plugin for Windows - Improper Input Validation
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZW
Zoom Workplace for Windows · Zoom Communications
before 7.0.0 · source: vendor
WD
Workplace Desktop · Zoom
before 7.0.0 · source: NVD
WV
Workplace Virtual Desktop Infrastructure · Zoom
6.5.0 before 6.5.18; 6.6.0 before 6.6.15; 7.0.0 before 7.0.10 · source: NVD
In the news
VulnerabilityCritical
Zoom Fixes CVE-2026-53412, a Critical Account Takeover Bug
Zoom warns of a critical Windows flaw, tracked as CVE-2026-53412, that could let attackers take over accounts without authentication. Zoom has fixed a critical Windows vulnerability, tracked as CVE-2026-53412 (CVSS score of 9.8) that could allow unauthenticated attackers to hijack user accounts. The flaw affects older versions of Workplace, the Windows VDI Client, and the […]
Jul 16, 2026·Security Affairs
VulnerabilityCritical
Zoom Patches Critical Windows Flaw That Could Enable Account Takeover
Zoom has released security updates for a critical security flaw impacting Zoom Workplace for Windows that could facilitate account takeover.
The vulnerability, tracked as CVE-2026-53412 (CVSS score: 9.8), affects Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows.
"Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for
Jul 16, 2026·The Hacker News