Zoom Patches Critical Windows Flaw Enabling Unauthenticated Account Takeover

Zoom has disclosed a critical-severity vulnerability in its Windows desktop client and Windows SDK, warning that an unauthenticated remote attacker can exploit it to fully hijack victim accounts — no credentials required on the attacker's side.

What Happened

Zoom published a security advisory covering a critical flaw in both its Windows desktop application and its Windows software development kit. As BleepingComputer reports, the vulnerability is exploitable by an unauthenticated party — the attacker needs no Zoom account and, in the worst-case scenario, no interaction from the victim. The outcome is complete account takeover.

Why It Matters

Zoom is embedded deeply in enterprise workflows: meetings, recordings, calendar integrations, SSO chains, shared files, and internal communications all flow through it. An attacker who seizes a Zoom account can:

• Impersonate executives or IT staff in live meetings
• Access every recorded meeting and file the victim has shared
• Use the compromised identity to social-engineer colleagues in real time
• Authenticate into any SSO-connected service the account is federated with

The SDK scope makes this worse than a standard client bug. If your team ships software that embeds the Zoom Windows SDK, your own application inherits the vulnerability and your users become exposed — not just your employees.

The unauthenticated exploitation path is what puts this in the same-day patch category. Bugs requiring prior authentication give defenders a chokepoint; this one does not. Critical unauthenticated RCE and account-takeover vulnerabilities in enterprise software are consistently weaponized within 24–72 hours of public disclosure.

What To Do

1. Patch the Zoom desktop client on every Windows machine now. Open Zoom → profile picture → Check for Updates. Or download the latest installer directly from zoom.us/download. Don't rely on auto-update cadence.

2. If you ship software using the Zoom Windows SDK, treat this as a build emergency. Pull the patched SDK version from the Zoom developer portal, rebuild, and push a new release. Your users are at risk until you do.

3. Push a forced update via MDM or endpoint management. User-driven updates are too slow. If you manage a fleet, deploy the Zoom update as a mandatory policy today.

4. Audit active Zoom sessions. In the Zoom web portal: My Account → Devices. Sign out anything unfamiliar.

5. Watch for post-compromise indicators. Meeting recordings you didn't create, calendar invites sent from your account without your knowledge, or logins from unexpected geolocations are all signals to investigate immediately.

Zoom has not confirmed active exploitation in the wild at time of writing. That window is short. Patch first, verify after.