Zoom Certificate Validation Flaw Could Expose Sensitive Data

Two high-severity security flaws in Zoom clients could expose sensitive information to attackers over a network, even without login credentials. The vulnerabilities affect Windows applications and the My Notes feature across desktop and mobile devices.

The flaws, tracked as CVE-2026-108184 and CVE-2026-108185, have CVSS v3.1 scores of 7.4. Zoom Offensive Security reported both issues in security bulletins dated October 13, 2026.

The available advisories describe information disclosure risks but do not confirm the exact information that could be exposed or whether attackers have exploited the flaws.

Zoom Certificate Validation Vulnerabilities

Certificate validation helps applications verify that they are communicating with trusted systems. If these checks do not work correctly, software may accept connections that should be rejected, potentially putting sensitive communications at risk.

The two Zoom vulnerabilities involve certificate validation, but the published details do not specify the exact validation failure or the method an attacker would use. There is also no confirmation that these flaws allow attackers to steal passwords, take over accounts, or execute malicious code.

CVE-2026-108184, documented in bulletin ZSB-26021, affects certain Windows-based Zoom applications. The affected products and version ranges include:

Zoom Workplace for Windows: Versions 7.0.0 and later in the affected range, before versions 7.2.0 or 7.1.9 in the respective release branches.
Zoom Workplace VDI Client for Windows: Versions 7.0.11 to before 7.0.13.
Zoom Rooms for Windows: Versions 7.0.0 to before 7.1.7.

CVE-2026-108185, documented in bulletin ZSB-26022, affects certificate validation in the My Notes feature. The affected versions include Zoom Workplace for Windows from version 7.1.5, and for macOS and Linux from version 7.0.5, within the ranges specified by Zoom.

Zoom Workplace for Android and iOS is also affected by the My Notes vulnerability, starting at version 7.0.5 and continuing before version 7.2.0.

Recommended Security Updates

Organizations and individual users should review their installed Zoom versions and apply the appropriate security updates. The required fixed version depends on the product, operating system, and release branch.

Security teams should prioritize the following actions:

Update affected applications: Install the latest supported releases from Zoom’s official Download Center.
Audit all deployments: Check standard Workplace clients, VDI installations, Zoom Rooms, and devices using My Notes.
Verify updates: Confirm that affected systems have moved to fixed versions after deployment.
Coordinate across teams: Include remote devices and systems managed by separate IT teams in the update process.
Follow official guidance: Review Zoom’s security bulletins for additional information and remediation instructions.

Disabling My Notes should not be treated as a confirmed workaround unless Zoom explicitly recommends it.

These vulnerabilities highlight the importance of keeping collaboration software updated across an organization’s entire environment. Applying patches consistently and verifying installed versions can help reduce exposure to known security weaknesses.