Zoom Workplace for Windows Critical Authentication Flaw Enables Unauthenticated Account Takeover (CVE-2026-53412)

Scope: Zoom Workplace for Windows Prior to Version 7.0.0 and Zoom Workplace VDI Client for Windows Prior to Version 7.0.10, 6.6.15, and 6.5.18

Severity: Red

Zoom patched CVE-2026-53412 (CVSS 9.8) this week, a critical improper input validation vulnerability in Zoom Workplace for Windows that allows any unauthenticated attacker with network access to take over Zoom accounts with no credentials and no user interaction required. Zoom is one of the most widely deployed video conferencing platforms across Ugandan government agencies, universities, enterprises, and NGOs, making this a broad-surface risk for any organization using Zoom on Windows endpoints. Three companion high-severity elevation of privilege flaws (CVE-2026-53409, CVE-2026-53410, CVE-2026-53411) affecting Zoom Rooms and Zoom VDI Plugin were also addressed in the same release. Users must update Zoom Workplace for Windows to version 7.0.0 or later immediately via the built-in update prompt or by downloading directly from zoom.us/download.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.