Patch Zoom Clients to Block Network-Based Certificate Validation Flaws
Two high-severity flaws in Zoom Workplace and My Notes allow unauthenticated attackers to access sensitive data over a network, requiring immediate version checks.
Key points
- CVE-2026-108184 and CVE-2026-108185 carry CVSS 7.4 scores and affect Windows, macOS, Linux, Android, and iOS clients.
- Attackers need network access but do not require login credentials to exploit these improper certificate validation issues.
- Updates are branch-specific; administrators must verify versions for Workplace, VDI, and Rooms separately.
Zoom disclosed two high-severity certificate validation flaws on October 13, 2026, that could allow unauthenticated attackers to access sensitive information via network connections, according to advisory text from Cyber Security News. The vulnerabilities, identified as CVE-2026-108184 and CVE-2026-108185, each hold a CVSS v3.1 score of 7.4. Zoom Offensive Security reported both issues. The advisories describe risks of information disclosure but do not specify the exact data exposed, provide attack examples, or confirm whether exploitation has occurred in the wild.
The risk
Certificate validation ensures software communicates with trusted services. When these checks fail, applications may accept connections they should reject, according to MITRE, which classifies this as improper certificate validation. This weakness can allow attackers to impersonate trusted systems or interfere with protected communications.
However, the specific attack method for these Zoom flaws remains unclear, as the disclosures do not detail whether the issue involves certificate trust, expiry checks, or server identity. Claims about stealing passwords or meeting recordings go beyond the available details, which specify information disclosure rather than remote code execution or account takeover.
Who is exposed
CVE-2026-108184 affects Windows clients, specifically Zoom Workplace releases from version 7.0.0 before 7.2.0 and 7.1.9 in their respective branches, according to Zoom bulletin ZSB-26021. It also impacts Zoom Workplace VDI Client for Windows from version 7.0.11 before 7.0.13, and Zoom Rooms for Windows from version 7.0.0 before 7.1.7. CVE-2026-108185 affects the My Notes feature across desktop and mobile platforms. On Windows, affected Workplace releases start at 7.1.5; on macOS and Linux, they start at 7.0.5. Android and iOS Workplace versions from 7.0.5 before 7.2.0 are also vulnerable, per GBHackers.
Cost and compliance
The provided source material does not contain information regarding financial costs, regulatory fines, or compliance implications associated with these vulnerabilities.
Our take on the response
Administrators must treat this as an urgent configuration task, not just a software update. Because the fix targets depend on the specific release branch installed, a blanket update script may fail to address VDI or Rooms environments. Teams should audit their inventory to ensure every client type receives the correct version for its lineage.
What defenders should look for
Teams usually monitor for anomalous traffic patterns from client endpoints that suggest unauthorized data exfiltration or unusual certificate negotiation failures in network logs. Check whether internal firewalls or proxies are seeing repeated connection attempts to Zoom services with mismatched or invalid certificates. Look for alerts indicating sensitive data leaving standard ports without expected encryption handshakes. Containment moves typically involve isolating affected endpoints from the broader network to prevent further data leakage while verifying their software versions and applying updates.
Background: Account takeover
Account takeover protection stops attackers from using stolen credentials by verifying identity through multiple factors and monitoring login patterns. You secure accounts by enforcing multi-factor authentication, checking for impossible travel, and validating device fingerprints to ensure the person logging in matches the expected user profile.
Read the full guide: Account Takeover Protection: Mechanisms, Trade-offs, and Defense
What to do and how to stay safe: Zoom
- Inventory all Zoom Workplace, VDI, and Rooms installations to identify versions falling within the vulnerable ranges specified in the advisories.
- Prioritize updating Windows clients first, as they are affected by both CVE-2026-108184 and CVE-2026-108185, ensuring you match the correct branch-specific fix.
- Verify that mobile devices on Android and iOS are updated to version 7.2.0 or later to address the My Notes vulnerability.
- Monitor network logs for unusual outbound traffic from Zoom clients that could indicate attempted exploitation or data disclosure.
Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Do these flaws allow remote code execution?
No, the advisories specifically identify information disclosure risks, not remote code execution or account takeover capabilities.
Which Zoom products are affected by CVE-2026-108184?
It affects Zoom Workplace for Windows, Zoom Workplace VDI Client for Windows, and Zoom Rooms for Windows within specific version ranges.
Is there a confirmed exploit in the wild?
The supplied disclosures do not state whether either flaw has been exploited by attackers.
