Zoom Multiple Vulnerabilities

Multiple vulnerabilities (with CVE-2026-53413, CVE-2026-53414, CVE-2026-53415, and CVE-2026-53416) have been identified in several Zoom products. According to HKCERT, a remote attacker may exploit these vulnerabilities to trigger remote code execution, information disclosure, or data manipulation on affected systems. The vulnerabilities affect widely used Zoom components, including Zoom Workplace, Zoom Rooms, and Zoom Meeting SDK. System owners and LAN administrators are strongly advised to review affected systems and apply the latest security updates released by Zoom as soon as possible to reduce potential security risks.

Vulnerability

• Zoom Zero-Click Vulnerabilities (CVE-2026-53413, CVE-2026-53414, CVE-2026-53415, and CVE-2026-53416)

Severity Level

• From High to Medium

Affected Products

• Zoom Meeting SDK prior to version 7.1.5
• Zoom Rooms prior to version 7.1.5
• Zoom Workplace prior to versions 7.1.5 and 7.0.6 (in their respective branches)
• Zoom Workplace VDI Client for Windows prior to versions 7.0.11 and 6.6.16
• Zoom Workplace VDI Plugin prior to versions 7.0.11 and 6.6.15

Recommended Actions

• Review all Zoom installations under your administration and identify affected versions.
• Upgrade affected Zoom products to the latest vendor-supported versions.
• Ensure Zoom Rooms and departmental meeting devices receive the required updates.
• Inform end users to update their Zoom clients if updates are not centrally managed.
  • Users can help protect their systems by updating Zoom to the latest available version via the Zoom Download Center or by selecting Check for Updates from the Zoom desktop client.
• Verify that automatic update settings are enabled where appropriate.

Reference

• HKCERT: Zoom Products Multiple Vulnerabilities
• Zoom: Security Bulletins
• MITRE: CVE-2026-53413
• MITRE: CVE-2026-53414
• MITRE: CVE-2026-53415
• MITRE: CVE-2026-53416
• Cyber Security News: Zoom Zero-Click Vulnerabilities Allow Meeting Participants to Hijack Other Users’ Devices

Published on: 12 August 2026