CVE-2024-39818: Zoom Workplace Apps and SDKs - Protection Mechanism Failure

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-14 · updated 2026-06-17
Weakness: CWE-522

Description

Protection mechanism failure for some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct information disclosure via network access.

Affected products

Zoom Video Communications, Inc. Zoom Rooms for Windows: before 6.0.0 — fixed in 6.0.0
Zoom Workplace: before 6.0.0 — fixed in 6.0.0
Zoom Communications, Inc Zoom Workplace Desktop App for macOS: before 6.0.0 — fixed in 6.0.0
Zoom Communications Zoom Workplace VDI Plugin: before 5.17.13 — fixed in 5.17.13

How to fix

Upgrade to a fixed version: Zoom Video Communications, Inc. Zoom Rooms for Windows 6.0.0; Zoom Workplace 6.0.0; Zoom Communications, Inc Zoom Workplace Desktop App for macOS 6.0.0; Zoom Communications Zoom Workplace VDI Plugin 5.17.13. Check the vendor advisory for mitigations.

References

https://www.zoom.com/en/trust/security-bulletin/zsb-24022

Get alerted when CVE-2024-39818 or the next vulnerability affects your stack