Zoom issues emergency patch for Windows account takeover

Zoom has released an emergency security update to patch a critical vulnerability in its Windows applications that could allow an unauthenticated attacker to remotely hijack user accounts. The company disclosed the flaw this week, urging users of its Workplace desktop client, VDI Client, and Meeting SDK for Windows to update immediately.

The vulnerability, tracked as CVE-2026-53412, carries a maximum severity score of 9.8 out of 10. According to Zoom's security advisory, the flaw is an improper input validation issue that "may allow an unauthenticated user to conduct an account takeover via network access." This means an attacker could potentially seize control of a Zoom account without needing any prior access to the system or any interaction from the user. The company stated it discovered the flaw internally through its own security team and that there is no evidence it has been exploited in real-world attacks.

The affected software includes Zoom Workplace for Windows before version 7.0.0, Zoom Workplace VDI Client for Windows before versions 7.0.10, 6.6.15, and 6.5.18 in their respective branches, and the Zoom Meeting SDK for Windows before version 7.0.0. The fix is included...