Loading story…
Researchers documented a critical flaw in Zoom’s macOS ZoomOpener component, which exposed a local web server on port 19421. A malicious website could exploit weak suffix-based validation on the component’s launch endpoint by supplying a domain that merely ended in a trusted Zoom-domain string, causing ZoomOpener to download attacker-controlled content without sufficient integrity checks.
The attack could escalate to remote code execution by delivering a malicious macOS .terminal profile that NSWorkspace opened, running its configured startup command. Exploitation required a residual condition in which Zoom had been installed and later uninstalled while the vulnerable component remained in ~/.zoomus; Zoom and Apple subsequently fixed the issue, and the reported techniques no longer function on current versions.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Zoom and Apple released fixes addressing the disclosed attack techniques; the described exploitation paths no longer worked in current patched versions.
Jonathan Leitschuh independently published research on Zoom macOS client vulnerabilities involving the same underlying issue.
Assetnote disclosed CVE-2019-13567, a remote code execution vulnerability in Zoom's macOS ZoomOpener component. The local service on port 19421 accepted attacker-controlled update domains through flawed suffix validation, allowing a malicious .terminal profile to be downloaded and opened when a prior Zoom uninstall had left ZoomOpener behind.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zoom has released fixes for a critical Windows vulnerability, **CVE-2026-53412**, that could let an unauthenticated attacker take over user accounts over the network. The flaw, caused by improper input validation and rated **CVSS 9.8**, affects older versions of **Zoom Workplace for Windows** and the **Zoom VDI Client for Windows**; some reports also said the **Meeting SDK for Windows** was impacted, while a later advisory revision clarified the SDK was not affected. Zoom credited its Offensive Security team with finding the issue and urged customers to quickly identify vulnerable installations and apply patched versions. The company also fixed three high-severity local privilege escalation bugs—**CVE-2026-53409**, **CVE-2026-53410**, and **CVE-2026-53411**—across multiple Windows components, including Workplace, VDI, Zoom Rooms, and Contact Center-related software. Zoom said it had **no evidence of in-the-wild exploitation** at the time of disclosure, but advised organizations to update immediately and monitor for suspicious account or session activity following remediation.
Jul 30, 2026
Zoom released security updates to fix multiple vulnerabilities across several products, warning that successful exploitation could allow attackers to gain elevated privileges on affected systems. The most prominent issue, **CVE-2026-53407** with a **CVSS 8.1**, is an improper authorization flaw in the handler for a custom URL scheme in **Zoom Workplace Mobile Clients**. Affected products include **Zoom Workplace for Android and iOS**, **Zoom Meeting SDK for Android and iOS**, and **Remote Control for Zoom Contact Center for Windows**. Zoom provided fixed versions for the impacted software, and the advisory urges enterprises to deploy the patches as soon as internal testing is complete to reduce exposure.
Jul 8, 2026
Zoom has patched four vulnerabilities, including a severe zero-click remote code execution flaw tracked as **CVE-2026-53413** that could let a meeting participant silently take over another participant’s device during calls involving screen sharing and annotation. Researchers reported that the bug stemmed from memory corruption in Zoom’s annotator protocol and required no victim interaction or visible warning, affecting Zoom clients across all supported platforms. The issue was disclosed alongside broader concerns that anyone on a call could exploit the screen-sharing workflow to compromise another device. The vulnerabilities, branded **"Zoomsday"** by security firm A Security, also included annotation-related denial-of-service and use-after-free flaws, while Zoom separately fixed **CVE-2026-53416**, a path traversal information disclosure bug in the Workplace VDI Client and VDI Plugins. Zoom released patches in the **7.1.5** series for Workplace, Rooms, and Meeting SDK products, and the disclosure also drew attention because researchers said they used a public AI tool and fewer than 20 prompts to help identify the bug.
Aug 21, 2026