CVE-2026-53412

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 0.53%
EPSS Percentile: 44.58%
CISA KEV: Not listed

Description

Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network access.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 17-Jul-2026 05:17
Last Modified: 25-Oct-2026 03:10
EPSS Date: 2026-10-27
CWE: CWE-20

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

zoom / workplace_desktop Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 7.0.0
cpe:2.3:a:zoom:workplace_desktop:*:*:*:*:*:windows:*:*
zoom / workplace_virtual_desktop_infrastructure Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 6.5.0 · before (exclusive) 6.5.18
cpe:2.3:a:zoom:workplace_virtual_desktop_infrastructure:*:*:*:*:*:windows:*:*
zoom / workplace_virtual_desktop_infrastructure Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 6.6.0 · before (exclusive) 6.6.15
cpe:2.3:a:zoom:workplace_virtual_desktop_infrastructure:*:*:*:*:*:windows:*:*
zoom / workplace_virtual_desktop_infrastructure Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 7.0.0 · before (exclusive) 7.0.10
cpe:2.3:a:zoom:workplace_virtual_desktop_infrastructure:*:*:*:*:*:windows:*:*

References

[email protected]

Last enrichment sync: 28-Oct-2026 08:52
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

The most severe is CVE-2026-53412 (CVSS score of 9.8), a critical bug in Zoom’s Workplace and Workplace VDI Client for Windows that could allow remote, unauthenticated attackers to mount account takeover attacks. Splunk and Zoom Patch Multiple Vulnerabilities, Including Critical Flaws
Zoom has disclosed CVE-2026-53412, a critical improper input validation flaw in Zoom Workplace for Windows, the Zoom VDI Client, and the Zoom Meeting SDK for Windows that could let an unauthenticated attacker take over Zoom Fixes Critical Windows Account-Takeover Flaw

CVE (6)

Vendors (2)

Products (8)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.