Loading story…
Zoom has patched four vulnerabilities, including a severe zero-click remote code execution flaw tracked as CVE-2026-53413 that could let a meeting participant silently take over another participant’s device during calls involving screen sharing and annotation. Researchers reported that the bug stemmed from memory corruption in Zoom’s annotator protocol and required no victim interaction or visible warning, affecting Zoom clients across all supported platforms. The issue was disclosed alongside broader concerns that anyone on a call could exploit the screen-sharing workflow to compromise another device.
The vulnerabilities, branded "Zoomsday" by security firm A Security, also included annotation-related denial-of-service and use-after-free flaws, while Zoom separately fixed CVE-2026-53416, a path traversal information disclosure bug in the Workplace VDI Client and VDI Plugins. Zoom released patches in the 7.1.5 series for Workplace, Rooms, and Meeting SDK products, and the disclosure also drew attention because researchers said they used a public AI tool and fewer than 20 prompts to help identify the bug.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On August 11, 2026, researchers disclosed Zoom vulnerabilities in screen-sharing functionality that could let any participant on a call silently take over another participant’s device. The attack reportedly required no victim interaction and produced no visible indication to the target.
On August 11, 2026, Zoom announced fixes for four vulnerabilities in its products. The patched issues included three annotation-related flaws branded “Zoomsday,” led by CVE-2026-53413, a zero-click remote code execution bug, and CVE-2026-53416, a path traversal information disclosure flaw affecting VDI components.
The reference states the Zoom annotation vulnerabilities were discovered on 2026-06-08, and the researcher confirmed zero-click remote code execution across platforms on Zoom v7.0.5 on 2026-06-09. The chain involved three flaws later tracked as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourceheise.de
Open sourcecyberveille.ch
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcea.security
Open sourcesecurityweek.com
Open sourcewired.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zoom has released fixes for a critical Windows vulnerability, **CVE-2026-53412**, that could let an unauthenticated attacker take over user accounts over the network. The flaw, caused by improper input validation and rated **CVSS 9.8**, affects older versions of **Zoom Workplace for Windows** and the **Zoom VDI Client for Windows**; some reports also said the **Meeting SDK for Windows** was impacted, while a later advisory revision clarified the SDK was not affected. Zoom credited its Offensive Security team with finding the issue and urged customers to quickly identify vulnerable installations and apply patched versions. The company also fixed three high-severity local privilege escalation bugs—**CVE-2026-53409**, **CVE-2026-53410**, and **CVE-2026-53411**—across multiple Windows components, including Workplace, VDI, Zoom Rooms, and Contact Center-related software. Zoom said it had **no evidence of in-the-wild exploitation** at the time of disclosure, but advised organizations to update immediately and monitor for suspicious account or session activity following remediation.
Jul 30, 2026
Zoom released security updates to fix multiple vulnerabilities across several products, warning that successful exploitation could allow attackers to gain elevated privileges on affected systems. The most prominent issue, **CVE-2026-53407** with a **CVSS 8.1**, is an improper authorization flaw in the handler for a custom URL scheme in **Zoom Workplace Mobile Clients**. Affected products include **Zoom Workplace for Android and iOS**, **Zoom Meeting SDK for Android and iOS**, and **Remote Control for Zoom Contact Center for Windows**. Zoom provided fixed versions for the impacted software, and the advisory urges enterprises to deploy the patches as soon as internal testing is complete to reduce exposure.
Jul 8, 2026
Zoom disclosed and patched a **critical command-injection vulnerability** in *Zoom Node Multimedia Routers (MMRs)* that could allow **remote code execution** by a **meeting participant** over network access. The issue, tracked as **CVE-2026-22844** with a **CVSS 9.9**, affects Zoom Node MMR modules **prior to version 5.2.1716.0**; Zoom advised customers running **Zoom Node Meetings Hybrid (ZMH)** and **Zoom Node Meeting Connector (MC)** deployments to update to **5.2.1716.0 or later**. Zoom stated it has **no evidence of in-the-wild exploitation** at the time of disclosure. Separately, GitLab released fixes for multiple high-severity vulnerabilities in **GitLab CE/EE**, including issues that could enable **denial-of-service (DoS)** and a **two-factor authentication (2FA) bypass** (e.g., **CVE-2025-13927** and **CVE-2025-13928**, both CVSS 7.5, affecting broad version ranges). While reported alongside the Zoom update in one source, the GitLab items represent a distinct patch set and are not part of the Zoom MMR vulnerability event.
Jun 29, 2026