Vulnerability-Lookup

CVE-2026-53407 (GCVE-0-2026-53407)

Vulnerability from cvelistv5 – Published: 2026-06-12 17:56 – Updated: 2026-06-12 19:05

Summary

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-939 - Improper authorization in handler for custom URL scheme

Assigner

Zoom

References

1 reference

URL	Tags
https://www.zoom.com/en/trust/security-bulletin/z…

Impacted products

1 product

Vendor	Product	Version
Zoom Communications	Zoom Workplace	Affected: 0 , < 7.0.4 (custom)

Date Public

2026-06-10 12:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53407",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-12T19:05:09.823890Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-12T19:05:19.573Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Android",
            "iOS"
          ],
          "product": "Zoom Workplace",
          "vendor": "Zoom Communications",
          "versions": [
            {
              "lessThan": "7.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-06-10T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access.\u003c/p\u003e"
            }
          ],
          "value": "Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-939",
              "description": "CWE-939 Improper authorization in handler for custom URL scheme",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-12T17:56:26.755Z",
        "orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
        "shortName": "Zoom"
      },
      "references": [
        {
          "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-26010"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
    "assignerShortName": "Zoom",
    "cveId": "CVE-2026-53407",
    "datePublished": "2026-06-12T17:56:26.755Z",
    "dateReserved": "2026-06-09T10:12:34.854Z",
    "dateUpdated": "2026-06-12T19:05:19.573Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53407",
      "date": "2026-06-14",
      "epss": "0.00038",
      "percentile": "0.11791"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53407\",\"sourceIdentifier\":\"security@zoom.us\",\"published\":\"2026-06-12T19:16:29.973\",\"lastModified\":\"2026-06-12T19:16:29.973\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@zoom.us\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"security@zoom.us\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-939\"}]}],\"references\":[{\"url\":\"https://www.zoom.com/en/trust/security-bulletin/zsb-26010\",\"source\":\"security@zoom.us\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-53407\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-12T19:05:09.823890Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-12T19:05:15.789Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Zoom Communications\", \"product\": \"Zoom Workplace\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"7.0.4\", \"versionType\": \"custom\"}], \"platforms\": [\"Android\", \"iOS\"], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-06-10T12:00:00.000Z\", \"references\": [{\"url\": \"https://www.zoom.com/en/trust/security-bulletin/zsb-26010\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eImproper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-939\", \"description\": \"CWE-939 Improper authorization in handler for custom URL scheme\"}]}], \"providerMetadata\": {\"orgId\": \"99b9af0d-a833-4a5d-9e2f-8b1324f35351\", \"shortName\": \"Zoom\", \"dateUpdated\": \"2026-06-12T17:56:26.755Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-53407\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-12T19:05:19.573Z\", \"dateReserved\": \"2026-06-09T10:12:34.854Z\", \"assignerOrgId\": \"99b9af0d-a833-4a5d-9e2f-8b1324f35351\", \"datePublished\": \"2026-06-12T17:56:26.755Z\", \"assignerShortName\": \"Zoom\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-53407

Vulnerability from fkie_nvd - Published: 2026-06-12 19:16 - Updated: 2026-06-12 19:16

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	security@zoom.us	https://www.zoom.com/en/trust/security-bulletin/zsb-26010

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access."
    }
  ],
  "id": "CVE-2026-53407",
  "lastModified": "2026-06-12T19:16:29.973",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "security@zoom.us",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-06-12T19:16:29.973",
  "references": [
    {
      "source": "security@zoom.us",
      "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-26010"
    }
  ],
  "sourceIdentifier": "security@zoom.us",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-939"
        }
      ],
      "source": "security@zoom.us",
      "type": "Secondary"
    }
  ]
}

GHSA-XM5C-4GF9-QF8C

Vulnerability from github – Published: 2026-06-12 21:31 – Updated: 2026-06-12 21:31

Details

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-53407"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-939"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-12T19:16:29Z",
    "severity": "HIGH"
  },
  "details": "Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access.",
  "id": "GHSA-xm5c-4gf9-qf8c",
  "modified": "2026-06-12T21:31:44Z",
  "published": "2026-06-12T21:31:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53407"
    },
    {
      "type": "WEB",
      "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-26010"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2026-1839

Vulnerability from csaf_certbund - Published: 2026-06-09 22:00 - Updated: 2026-06-09 22:00

Summary

Zoom Video Communications Workplace: Mehrere Schwachstellen ermöglichen Privilegieneskalation

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Zoom Workplace ist eine Plattform, die Videokonferenz-, Chat-, Telefon- und Collaboration-Tools integriert, um Remote- und Hybrid-Arbeitsumgebungen in Unternehmen zu unterstützen.

Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Zoom Video Communications Workplace ausnutzen, um seine Privilegien zu erhöhen.

Betroffene Betriebssysteme: - Android - iPhoneOS

CVE-2026-53407

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Zoom Video Communications Workplace iOS <7.0.3 Zoom Video Communications / Workplace		iOS <7.0.3
Zoom Video Communications Workplace Android <7.0.4 Zoom Video Communications / Workplace		Android <7.0.4

CVE-2026-53408

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Zoom Video Communications Workplace iOS <7.0.3 Zoom Video Communications / Workplace		iOS <7.0.3
Zoom Video Communications Workplace Android <7.0.4 Zoom Video Communications / Workplace		Android <7.0.4

References

4 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.zoom.com/en/trust/security-bulletin/Z…	external
https://www.zoom.com/en/trust/security-bulletin/Z…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Zoom Workplace ist eine Plattform, die Videokonferenz-, Chat-, Telefon- und Collaboration-Tools integriert, um Remote- und Hybrid-Arbeitsumgebungen in Unternehmen zu unterst\u00fctzen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Zoom Video Communications Workplace ausnutzen, um seine Privilegien zu erh\u00f6hen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Android\n- iPhoneOS",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1839 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1839.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1839 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1839"
      },
      {
        "category": "external",
        "summary": "Zoom Security Bulletin ZSB-26009 vom 2026-06-09",
        "url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-26009/"
      },
      {
        "category": "external",
        "summary": "Zoom Security Bulletin ZSB-26010 vom 2026-06-09",
        "url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-26010/"
      }
    ],
    "source_lang": "en-US",
    "title": "Zoom Video Communications Workplace: Mehrere Schwachstellen erm\u00f6glichen Privilegieneskalation",
    "tracking": {
      "current_release_date": "2026-06-09T22:00:00.000+00:00",
      "generator": {
        "date": "2026-06-10T06:10:56.588+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1839",
      "initial_release_date": "2026-06-09T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-06-09T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Android \u003c7.0.4",
                "product": {
                  "name": "Zoom Video Communications Workplace Android \u003c7.0.4",
                  "product_id": "T055084"
                }
              },
              {
                "category": "product_version",
                "name": "Android 7.0.4",
                "product": {
                  "name": "Zoom Video Communications Workplace Android 7.0.4",
                  "product_id": "T055084-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:zoom:workplace:android__7.0.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "iOS \u003c7.0.3",
                "product": {
                  "name": "Zoom Video Communications Workplace iOS \u003c7.0.3",
                  "product_id": "T055085"
                }
              },
              {
                "category": "product_version",
                "name": "iOS 7.0.3",
                "product": {
                  "name": "Zoom Video Communications Workplace iOS 7.0.3",
                  "product_id": "T055085-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:zoom:workplace:ios__7.0.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Workplace"
          }
        ],
        "category": "vendor",
        "name": "Zoom Video Communications"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-53407",
      "product_status": {
        "known_affected": [
          "T055085",
          "T055084"
        ]
      },
      "release_date": "2026-06-09T22:00:00.000+00:00",
      "title": "CVE-2026-53407"
    },
    {
      "cve": "CVE-2026-53408",
      "product_status": {
        "known_affected": [
          "T055085",
          "T055084"
        ]
      },
      "release_date": "2026-06-09T22:00:00.000+00:00",
      "title": "CVE-2026-53408"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-53407 (GCVE-0-2026-53407)

FKIE_CVE-2026-53407

GHSA-XM5C-4GF9-QF8C

WID-SEC-W-2026-1839

Tags

Sightings

Nomenclature