Zoom patches critical Windows flaw rated 9.8 in Workplace, VDI and Meeting SDK

Zoom disclosed a critical vulnerability, CVE-2026-53412, affecting its Windows software, UC Today reported on July 16, 2026. The flaw is rated 9.8 out of 10 and involves improper input validation that, according to the report, could let a network attacker take over accounts without authentication. Affected products include Zoom Workplace for Windows before version 7.0.0, the Windows VDI Client before versions 7.0.10, 6.6.15 and 6.5.18, and the Meeting SDK for Windows before 7.0.0. The same release fixed several high-severity privilege escalation issues, including in Zoom Rooms for Windows before 7.1.0.

Zoom said it had no evidence the vulnerabilities were being actively exploited at the time of disclosure. Even so, meeting clients sit on nearly every employee laptop, and a flaw that allows account takeover is the kind of issue attackers move on quickly once details are public. Conference room PCs and virtual desktop environments are easy to miss because nobody logs into them daily.

Ask your IT provider or internal team to confirm three things: that every Windows device running Zoom Workplace is on a fixed version, that the VDI client and plugin in any virtual desktop environment were updated separately, and that Zoom Rooms systems in meeting spaces are on 7.1.0 or later. If users can decline or postpone app updates, consider enforcing updates through your device management tool.

This is also a reasonable moment to check whether your managed services agreement covers third-party application patching, not just Windows updates, and how quickly critical patches are expected to be applied.