Zoom Certificate Validation Vulnerability Allows Attackers to Access Sensitive Information

Zoom has disclosed a high-severity vulnerability in the My Notes feature that affects multiple Zoom Workplace clients. This issue, tracked as CVE-2026-108185, could allow an unauthenticated attacker with network access to disclose sensitive information.

On October 13, 2026, Zoom published security bulletin ZSB-26022, which identifies the vulnerable releases across Windows, macOS, Linux, Android, and iOS, and advises users to install updated software.

Zoom Certificate Validation Vulnerability

The vulnerability has a CVSS v3.1 score of 7.4, with the metrics CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. These metrics indicate that the attack can be conducted over a network and requires high complexity, but does not require user privileges or interaction.

The assessment highlights significant potential impact on confidentiality and integrity, with no impact on availability. Zoom’s description specifically notes information disclosure as the potential exploitation outcome, rather than detailing an integrity-focused attack scenario.

The core issue involves improper certificate validation in the My Notes feature, not a general weakness affecting all Zoom communication channels.

The vulnerability involves a security check, but Zoom does not specify which certificate checks fail, which connections are affected, or what network conditions an attacker must establish.

While the advisory raises concerns about exposure through this feature, it does not claim that attackers can automatically intercept every meeting, retrieve account credentials, or compromise entire devices.

For Windows, the affected Zoom Workplace releases start with version 7.1.5 and include all versions before 7.2.0 and 7.1.9 in their respective branches.

On macOS and Linux, affected releases also start with version 7.0.5 and include versions before the same branch-specific fixes.

This distinction is important because the advisory identifies separate remediation boundaries rather than grouping all desktop installations under a single release sequence. Administrators should match each installed client to its applicable release branch when assessing exposure.

For mobile platforms, Zoom specifies that Workplace for Android and iOS versions starting from 7.0.5 and up to, but not including, 7.2.0 are affected.

Version 7.2.0 is noted as the specified fixed boundary for both mobile clients. Organizations evaluating exposure should consider these installations alongside desktop endpoints, as the published scope applies to all five operating systems. The bulletin does not list Zoom Rooms, browser access, or other Zoom products among the affected products.

Zoom credits its internal Zoom Offensive Security team with discovering the vulnerability. The advisory includes no exploit demonstration, technical attack sequence, or confirmation that exploitation has occurred in the wild.

Additionally, it does not specify the exact information that could be disclosed. These omissions limit the ability to conclude practical attack requirements and the precise sensitivity of potentially exposed information.

Immediate remediation involves applying the latest available Zoom updates. For managed deployments, the advisory provides platform and branch boundaries to help verify that affected clients have been updated to fixed releases.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.