CVE-2026-53412

—

CVSS 3.1

9.8 critical

EPSS

<1%p49

Published

Jul 16, 2026 (Jul 16, 2026)

Modified

Aug 11, 2026

Description

Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network access.

Vendors: zoom
Products: workplace desktop, workplace virtual desktop infrastructure
Weakness: CWE-20
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news3 stories

⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0

The Hacker NewsJul 21, 04:34 UTC · Jul 21, 2026Vulnerability in the wildCVE-2026-63030 CVE-2026-60137 CVE-2026-15409+26 CVEs

Zoom Patches Critical Windows Flaw That Could Enable Account Takeover

The Hacker NewsJul 17, 06:05 UTC · Jul 17, 2026Vulnerability CVE-2026-53412 CVE-2026-53411 CVE-2026-53410+1 CVEs

Zoom Fixes CVE-2026

Security AffairsJul 16, 07:41 UTC · Jul 16, 2026Exploit / PoC in the wildCVE-2026-53412 CVE-2026-53410 CVE-2026-53409+2 CVEs