Zoom Clients Vulnerable to Certificate Validation Flaws, Exposing Sensitive Information
Two high-severity certificate validation flaws in Zoom clients allow unauthenticated network attackers to potentially access sensitive information across multiple platforms.
Two high-severity certificate validation flaws affecting Zoom clients for Windows, macOS, Linux, Android, and iOS have been disclosed, potentially allowing unauthenticated network attackers to access sensitive information. The vulnerabilities, tracked as CVE-2026-108184 and CVE-2026-108185, each carry a CVSS v3.1 score of 7.4 and were reported by Zoom Offensive Security. While the advisories indicate information disclosure risks, the exact nature of the exposed data or whether exploitation has occurred remains unspecified.
These flaws impact certificate validation, a critical security mechanism that ensures applications communicate with trusted services. Improper validation can lead to attackers impersonating legitimate services or interfering with secure communications. The specific validation step compromised in these Zoom vulnerabilities is not detailed in the provided bulletins, leaving open questions about the precise attack vectors and the scope of potential data exfiltration, such as passwords, meeting recordings, or user notes.
CVE-2026-108184 affects several Zoom clients for Windows. This includes Zoom Workplace versions starting from 7.0.0 up to, but not including, 7.2.0 and 7.1.9 in their respective branches. The vulnerability also impacts Zoom Workplace VDI Client for Windows from version 7.0.11 to before 7.0.13, and Zoom Rooms for Windows from version 7.0.0 to before 7.1.7. Organizations must ensure these specific product lines are updated, as patching the standard Workplace app may not cover VDI or Rooms deployments.
CVE-2026-108185 specifically targets certificate validation within the "My Notes" feature. On Windows, affected Zoom Workplace versions range from 7.1.5 to before 7.2.0. For macOS and Linux, the vulnerability exists in versions from 7.0.5 to before 7.2.0 or 7.1.9. Zoom Workplace for Android and iOS are also affected, with vulnerable versions starting from 7.0.5 up to, but not including, 7.2.0. The bulletin does not specify if particular feature configurations are necessary for exploitation, and disabling "My Notes" is not confirmed as a workaround.
Users are strongly advised to update to the latest supported versions of Zoom clients to mitigate these risks. Zoom's official Download Center provides access to the patched software. Keeping Zoom applications current is a general recommendation from the company to receive ongoing security fixes and improvements.
For managed environments, administrators should meticulously check installed versions across all relevant Zoom products, including Windows Workplace, VDI, Rooms, and mobile and desktop "My Notes" clients. This proactive approach is crucial to identify and remediate installations that have not yet been updated, ensuring comprehensive security coverage across the organization.
These newly disclosed vulnerabilities follow a history of security issues affecting Zoom clients. While previous advisories and reports on unrelated Zoom flaws may offer context, their specific attack methods and consequences should not be conflated with these current certificate validation issues. The focus remains on the information disclosure risks posed by CVE-2026-108184 and CVE-2026-108185.