Zoom Patches Critical CVSS 9.8 Windows Flaw Enabling Account Takeover — Update Now

What Happened

Zoom has released an emergency patch for CVE-2026-53412, a critical vulnerability scoring 9.8 on the CVSS scale affecting Zoom Workplace for Windows, Zoom VDI Client for Windows, and Zoom Desktop Client for Windows. The flaw can be exploited to enable full account takeover. This lands the same week Russian threat actor UAT-11795 was caught distributing trojanized Zoom installers to deploy the Starland RAT backdoor for credential and cryptocurrency theft — making the Windows client a double target right now.

Why It Matters

A CVSS 9.8 is about as high as it gets before "already being mass-exploited." Account takeover via a meeting client means an attacker who triggers this flaw can impersonate the victim across all Zoom sessions, access recorded meetings, intercept live calls, and pivot to any integrated workspace tool (Slack, Google Drive, internal wikis) that uses Zoom SSO. Zoom is installed on virtually every corporate Windows machine, which makes the blast radius enormous.

The timing with the trojanized installer campaign is not reassuring. Even users who would never click a phishing link may be running a legitimately-installed but outdated Zoom client that is now trivially exploitable. VDI environments are particularly exposed — a single unpatched VDI host can be the bridge to thousands of user sessions.

What to Do

Patch immediately. Zoom auto-updates, but do not rely on it for a 9.8.

1. Force-update all Windows endpoints running Zoom Desktop Client or Zoom VDI Client. Push via your MDM/endpoint management tool today — do not wait for the next maintenance window.
2. Verify the version shipped meets or exceeds the fixed version listed in the Zoom security bulletin. Pin that minimum version in your software inventory policy.
3. Audit VDI gold images — unpatched VDI templates will re-propagate the vulnerability every time a new session spins up.
4. Cross-reference installer hashes if you distribute Zoom internally. The Starland RAT campaign proves threat actors are actively weaponizing Zoom packages; validate that your internal distribution point is pulling from Zoom's official CDN and check hashes.
5. Review Zoom SSO integrations — if account takeover is possible, audit which downstream systems a compromised Zoom identity can reach and consider temporarily requiring step-up MFA for those services until the patch is confirmed deployed fleet-wide.

If you run a federal agency, note that CISA's KEV deadline pressure is currently focused on Oracle E-Business Suite (patch by Saturday), but a 9.8 in Zoom will almost certainly follow. Don't wait for the KEV listing — patch now.