CVE-2026-53407

CriticalCVSS 9.8/10Last modified Oct 25, 2026

Description

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-939

Affected software

Vendor	Product	Versions
Zoom Communications	Zoom Workplace	< 7.0.4

References

https://www.zoom.com/en/trust/security-bulletin/zsb-26010Vendor Advisory

Timeline

Published: Jun 12, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-534088.1Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allo CVE-2026-534097.8Improper Privilege Management in Zoom Rooms for Windows before version 7.1.0 may allow an authenticated user to conduct an escalation of pri CVE-2026-53416.4The NMR Strava activities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `strava_nmr_connect` shortcode CVE-2026-534107.0A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows co CVE-2026-534117.0A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows co CVE-2026-534129.8Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an una CVE-2026-534138.3Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve re CVE-2026-534146.5Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a d CVE-2026-534158.3Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another partici CVE-2026-534167.1Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access.CVE-2026-534188.1Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user CVE-2026-53425.3A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikon_load_padded_packed_raw of the file src/decoders/decode