Zoom Fixes High-Severity Certificate Flaws in Workplace Clients

Zoom released security bulletins on October 13, 2026, addressing two high-severity certificate validation flaws in its workplace clients. According to Cyber Security News, these issues could allow unauthenticated attackers with network access to disclose sensitive information. The vulnerabilities are tracked as CVE-2026-108184 and CVE-2026-108185.

Both flaws received a CVSS v3.1 score of 7.4, indicating high severity. Zoom Offensive Security reported the issues to the vendor. The advisory text does not specify the exact type of sensitive data at risk, nor does it confirm whether exploitation has occurred in the wild. Zoom’s description specifically notes information disclosure as the potential exploitation outcome.

Context and Background

Certificate validation ensures software communicates only with trusted services. When these checks fail, applications may accept connections they should reject. MITRE describes this as improper certificate validation, which can enable attackers to impersonate trusted systems or interfere with protected communications. However, the specific attack method for these Zoom flaws remains undefined in the disclosures.

The vulnerabilities do not affect all communication channels within the Zoom ecosystem. CVE-2026-108185 specifically involves the My Notes feature. The supplied disclosures do not state whether the problem involves certificate trust, expiry checks, or server identity verification. Claims that attackers can steal passwords or meeting recordings go beyond the available details provided by Zoom.

Affected Versions and Platforms

CVE-2026-108184 affects Windows clients, including Zoom Workplace, VDI Client, and Zoom Rooms. Workplace releases from version 7.0.0 up to, but not including, 7.2.0 and 7.1.9 are vulnerable. The VDI Client is affected from version 7.0.11 to before 7.0.13. Zoom Rooms for Windows is affected from version 7.0.0 to before 7.1.7. Businesses must check these products separately, as updating the standard app does not fix virtual desktop or room systems.

CVE-2026-108185 affects the My Notes feature across multiple platforms. On Windows, affected Workplace releases start at version 7.1.5. On macOS and Linux, affected releases begin at version 7.0.5. For mobile platforms, Android and iOS versions from 7.0.5 up to, but not including, 7.2.0 are vulnerable. Version 7.2.0 is the specified fixed boundary for both mobile clients.

What should you do?

Administrators should verify the versions of all Zoom clients installed in their environments, including VDI and Zoom Rooms systems. Users should install the latest updates immediately to mitigate the risk of information disclosure. Organizations should monitor network traffic for unusual certificate validation errors or unauthorized connection attempts. IT teams should ensure that mobile device management policies enforce the required version updates for Android and iOS devices.

What to do and how to stay safe: Zoom

• Inventory all Zoom client installations, including Workplace, VDI, and Rooms, to identify vulnerable versions.
• Deploy updates to reach the fixed versions: 7.2.0 or 7.1.9 branches for Workplace, and 7.2.0 for mobile.
• Monitor network logs for signs of unauthorized access attempts or certificate validation failures.
• Educate users on the importance of keeping meeting software updated to prevent information disclosure.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What are the CVE IDs for the Zoom certificate flaws?

The vulnerabilities are tracked as CVE-2026-108184 and CVE-2026-108185.

Which Zoom products are affected by CVE-2026-108184?

This flaw affects Zoom Workplace, VDI Client, and Zoom Rooms for Windows, but not mobile clients.

Is there evidence that these flaws are being exploited?

No, the advisory text does not state whether either flaw has been exploited in the wild.