ZOOM has published security bulletins describing four high-severity flaws in its Zoom Workplace clients, each classified as not yet exploited but with patches available. The vulnerabilities include two that enable privilege escalation and two that could lead to information disclosure due to weak certificate checks. Users are advised to update to Zoom Workplace 7.2.0 or newer to mitigate the majority of issues, with Android devices requiring 7.2.1 or later and related components updated to specific builds.
The four CVEs are CVE-2026-53418 (CVSS 8.1, CWE-939) tied to improper authorisation in a handler for a custom URL scheme in Zoom Workplace for Android, and CVE-2026-53420 (CVSS 8.0, CWE-120) involving a buffer overflow in the Zoom Phone feature of Zoom Workplace clients. The information-disclosure flaws are CVE-2026-108184 (CVSS 7.4, CWE-295) due to improper certificate validation in some Windows clients, and CVE-2026-108185 (CVSS 7.4, CWE-295) related to the My Notes feature across major platforms.
Weak certificate checks could allow a network-positioned attacker to intercept traffic and read data. Affected versions include Zoom Workplace before 7.2.0 (CVE-2026-53420); Android before 7.2.1 (CVE-2026-53418); Windows, VDI Windows clients, and Zoom Rooms on older 7.x builds (CVE-2026-108184); and Windows, macOS, Linux, Android, iOS on 7.x builds (CVE-2026-108185). Patches are available in versions 7.2.1, 7.2.0, 7.0.13 for the VDI client, and 7.1.7 for Zoom Rooms. Admins should push fixes via managed updates.