Zoom Clients for Certificate Validation Flaw Exposes Sensitive Information via Network Access

Two high-severity certificate validation flaws in Zoom clients could allow attackers without login credentials to access sensitive information over a network, according to advisory text dated October 13, 2026.

The issues affect Windows clients and the My Notes feature across desktop and mobile platforms, making updates important for both personal users and business deployments.

The vulnerabilities, tracked as CVE-2026-108184 and CVE-2026-108185, each carry a CVSS v3.1 score of 7.4. Zoom Offensive Security reported both.

The supplied bulletins describe information disclosure risks but do not identify the exact data that could be exposed, provide an attack example, or state whether either flaw has been exploited.

Zoom Certificate Validation Flaw

Certificate validation helps software check that it is communicating with a trusted service. When those checks fail, an application may accept a connection it should reject.

MITRE describes this weakness as improper certificate validation and explains that it can let attackers impersonate trusted systems or interfere with protected communications.

That general risk does not establish the precise attack method for these Zoom flaws. The supplied disclosures do not say whether the problem involves certificate trust, expiry checks, server identity, or another validation step.

Claims that attackers can steal passwords, meeting recordings, or all user notes would therefore go beyond the available details. Zoom’s descriptions specifically identify information disclosure, not remote code execution or account takeover.

According to security bulletins published by Zoom, CVE-2026-108184 appears in bulletin ZSB-26021 and concerns certain Zoom clients for Windows.

Affected Zoom Workplace releases start at version 7.0.0 and remain vulnerable before versions 7.2.0 and 7.1.9 in their respective branches. This branch wording matters because the correct update target depends on the release line installed.

The same flaw affects Zoom Workplace VDI Client for Windows from version 7.0.11 to before 7.0.13. Zoom Rooms for Windows is affected from version 7.0.0 to before 7.1.7.

Businesses should check these products separately rather than assume that updating the standard Workplace app also fixes virtual desktop clients or meeting room systems.

CVE-2026-108185, described in ZSB-26022, affects certificate validation in My Notes. On Windows, the affected Workplace range begins at 7.1.5. On macOS and Linux, it begins at 7.0.5.

Each desktop platform requires version 7.2.0 or 7.1.9 in its respective branch to move beyond the listed affected range. Zoom Workplace for Android and iOS is also affected by the My Notes issue, starting at version 7.0.5 and continuing before 7.2.0. The bulletin does not explain whether specific feature settings are required for exploitation.

Disabling My Notes should not be presented as a confirmed workaround without further guidance from Zoom. Users should install the latest supported release through Zoom’s official Download Center. Zoom’s security bulletin page also recommends keeping its software current to receive security fixes and improvements.

For managed environments, the affected version ranges provide a practical starting point for checking which installations still need attention.

Administrators should confirm installed versions after deployment, including devices outside the main office and systems maintained by separate teams.

A completed rollout should cover Windows Workplace, VDI, Rooms, and affected mobile and desktop My Notes clients, rather than only the most visible employee laptops.

These disclosures follow earlier Zoom client vulnerabilities and a separate Windows account takeover flaw. Those reports offer useful background, but their attack methods and consequences should not be applied to these new certificate issues.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post Zoom Clients for Certificate Validation Flaw Exposes Sensitive Information via Network Access appeared first on Cyber Security News.