TI-2026-71845 Aliases CVE-2026-108184 GHSA-hqpx-mx62-25m9

Improper certificate validation in Zoom Clients for Windows

LOW 32CWE-295Published 2026-10-13 · Updated 2026-10-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Spoofing
Confidentiality · integrity · availability: High · High · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

Improper certificate validation in certain Zoom Clients for Windows lets an unauthenticated attacker with network access view information they should not see. The flaw is a failure to properly validate certificates (CWE-295), so connections may be trusted without a correct check. Exploitation requires high attack complexity, and the attacker can read and modify data.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00204 10th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Zoom Video Communications, Inc.	Zoom Clients	see references	—	No fix listed	CNA

Zoom Clients VendorZoom Video Communications, Inc. Affected see references Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Zoom Clients for Windows. Check the Zoom security bulletin referenced by the advisory for affected version details and updates.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Timeline

2026-10-13 Threatist record created from CVE-2026-108184
2026-10-13 Alias added: GHSA-hqpx-mx62-25m9
2026-10-14 Priority changed: MEDIUM → LOW
2026-10-16 CISA SSVC decision points changed

References

Other 1

https://www.zoom.com/en/trust/security-bulletin/zsb-26021

TI-2026-18340 Zoom Node Deployments - Command Injection CVSS 3.1CRITICAL 9.9
TI-2017-11048 The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not… CVSS 3.1HIGH 8.8
TI-2017-11047 Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux… CVSS 3.1HIGH 8.8
TI-2020-04976 Path traversal in Zoom CVSS 3.1CRITICAL 9.8
TI-2026-38498 Zoom Workplace VDI Plugin for Windows - Improper Input Validation CVSS 3.1CRITICAL 9.8
TI-2021-13217 Improper certificate validation in Zoom Client for Meetings for Windows CVSS 3.1CRITICAL 9.8

See all 252 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences