What’s Vulnerable › Vulnerabilities
CVE-2026-53410: Zoom Clients for Windows - Race Condition
- Severity: high (CVSS 7.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-16 · updated 2026-10-24
- Weakness: CWE-367
Description
A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges.
Affected products
- Zoom Remote Control For Zoom Contact Center: before 7.0.0 — fixed in 7.0.0
- Zoom Video Communications, Inc. Zoom Rooms for Windows: before 7.0.5 — fixed in 7.0.5
- Zoom Communications, Inc Zoom Workplace Desktop App for macOS: before 7.0.5 — fixed in 7.0.5
- Zoom Communications Zoom Workplace VDI Plugin: before 6.5.17; from 6.6.0 before 6.6.14 — fixed in 6.5.17, 6.6.14
How to fix
Upgrade to a fixed version: Zoom Remote Control For Zoom Contact Center 7.0.0; Zoom Video Communications, Inc. Zoom Rooms for Windows 7.0.5; Zoom Communications, Inc Zoom Workplace Desktop App for macOS 7.0.5; Zoom Communications Zoom Workplace VDI Plugin 6.5.17, 6.6.14. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-53410 or the next vulnerability affects your stack