Zoom Communications vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-53420 Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.High 8 · Oct 13, 2026
• CVE-2026-53418 Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalHigh 8.1 · Oct 13, 2026
• CVE-2026-108185 Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via netwoHigh 7.4 · Oct 13, 2026
• CVE-2026-108184 Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.High 7.4 · Oct 13, 2026
• CVE-2026-53416 Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access.High 7.1 · Aug 11, 2026
• CVE-2026-53415 Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network accHigh 8.3 · Aug 11, 2026
• CVE-2026-53413 Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution High 8.3 · Aug 11, 2026
• CVE-2026-53412 Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user toCritical 9.8 · Jul 16, 2026
• CVE-2026-53411 A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authentHigh 7.8 · Jul 16, 2026
• CVE-2026-53410 A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authentHigh 7 · Jul 16, 2026
• CVE-2026-53409 Improper Privilege Management in Zoom Rooms for Windows before version 7.1.0 may allow an authenticated user to conduct an escalation of privilege via local accHigh 7.8 · Jul 16, 2026
• CVE-2026-53408 Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticatedHigh 8.1 · Jun 12, 2026
• CVE-2026-53407 Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticatedHigh 8.1 · Jun 12, 2026
• CVE-2026-53406 Insufficient Verification of Data Authenticity in Remote Control for Zoom Contact Center for Windows before version 7.0.0 may allow an authenticated user to enaHigh 7.8 · Jun 12, 2026
• CVE-2026-30906 Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via High 7.8 · May 13, 2026
• CVE-2026-30905 External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to condHigh 7.8 · May 13, 2026
• CVE-2026-30903 External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation Critical 9.6 · Mar 11, 2026
• CVE-2026-30902 Improper Privilege Management in certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access.High 7.8 · Mar 11, 2026
• CVE-2026-30901 Improper Input Validation in Zoom Rooms for Windows before 6.6.5 in Kiosk Mode may allow an authenticated user to conduct an escalation of privilege via local aHigh 7 · Mar 11, 2026
• CVE-2026-30900 Improper Check of minimum version in update functionality of certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilHigh 7.8 · Mar 11, 2026
• CVE-2026-22844 A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code executCritical 9.9 · Jan 20, 2026
• CVE-2025-67460 Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilegHigh 7.8 · Dec 10, 2025
• CVE-2025-62484 Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of High 8.1 · Nov 13, 2025
• CVE-2025-64741 Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via High 8.1 · Nov 13, 2025
• CVE-2025-64740 Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user to conduct an escalaHigh 7.5 · Nov 13, 2025