HighAPTCVE-2026-108184
Zoom Clients for Certificate Validation Flaw Exposes Sensitive Information via Network Access
Cyber Security News·Source published ·1 min read
What happened?
Two high-severity certificate validation flaws in Zoom clients could allow attackers without login credentials to access sensitive information over a network, according to advisory text dated October 13, 2026. The issues affect Windows clients and the My Notes feature across desktop and mobile platforms, making updates important for both personal users and business deployments. The vulnerabilities, tracked as CVE-2026-108184 and CVE-2026-108185, each carry a CVSS v3.1 score of 7.4. Zoom Offensive Security reported both.
Key details
- Two Zoom certificate validation flaws allow unauthenticated attackers to access sensitive information over a network.
- CVE-2026-108184 affects Windows Zoom clients and the My Notes feature across desktop and mobile platforms.
- CVE-2026-108184 vulnerable versions of Zoom Workplace start at 7.0.0 and require update to 7.2.0 or 7.1.9.
- CVE-2026-108184 also affects VDI Client versions 7.0.11 to before 7.0.13 and Zoom Rooms for Windows 7.0.0 to before 7.1.7.
- CVE-2026-108185 affects My Notes certificate validation on Windows starting at 7.1.5, macOS and Linux starting at 7.0.5.
- CVE-2026-108185 also affects Android and iOS Zoom Workplace from version 7.0.5 before 7.2.0.
- Zoom recommends updating to the latest supported release via the official Download Center as the primary fix.
Affected
- Zoom Workplace for Windows versions 7.0.0 to before 7.2.0 and 7.1.9.
- Zoom Workplace VDI Client for Windows versions 7.0.11 to before 7.0.13.
- Zoom Rooms for Windows versions 7.0.0 to before 7.1.7.
- Zoom Workplace for Android and iOS versions 7.0.5 to before 7.2.0 affected by CVE-2026-108185.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.