What’s Vulnerable › Vulnerabilities

CVE-2021-34420: Zoom Windows installation executable signature bypass

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-11-11 · updated 2026-06-17
• Weakness: CWE-347

Description

The Zoom Client for Meetings for Windows installer before version 5.5.4 does not properly verify the signature of files with .msi, .ps1, and .bat extensions. This could lead to a malicious actor installing malicious software on a customer’s computer.

Affected products

• Zoom Video Communications Inc Zoom Client for Meetings for Windows: before 5.4.4 — fixed in 5.4.4

How to fix

Upgrade to a fixed version: Zoom Video Communications Inc Zoom Client for Meetings for Windows 5.4.4. Check the vendor advisory for mitigations.

References

• https://explore.zoom.us/en/trust/security/security-bulletin
• https://medium.com/manomano-tech/a-red-team-operation-leveraging-a-zero-day-vulnerability-in-zoom-80f57fb0822e
• https://explore.zoom.us/en/trust/security/security-bulletin
• https://medium.com/manomano-tech/a-red-team-operation-leveraging-a-zero-day-vulnerability-in-zoom-80f57fb0822e

Get alerted when CVE-2021-34420 or the next vulnerability affects your stack