InfoSecBulletin Cybersecurity for mankind
A serious security flaw in Zoom might let a hacker take control of someone else’s device in a live meeting without the victim needing to click a link, download anything, or do anything else.
The weakness, dubbed “Zoomsday,” was found by a cybersecurity company called A Security using open AI models. Scientists said they spotted the flaw and created a working fix in under 24 hours with fewer than 20 AI prompts.
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
The vulnerability affected Zoom’s annotation functionality and could be exploited simply by having an attacker and victim in the same meeting. A Security said the issue affected Zoom clients across Windows, macOS, Linux, iOS and Android.
Zero-Click Attack Through Zoom Annotation
The vulnerability resides in Zoom’s proprietary annotation protocol. The feature allows participants to draw, add text, shapes and other objects while sharing a screen or using a digital whiteboard.
According to the researchers, Zoom clients automatically handle annotation messages from other users. A specially made message could cause memory issues in the receiving client and let harmful code run.
The victim didn’t have to engage with the harmful content. An attacker could join or run a meeting and aim at other attendees from afar, with no clear sign that an attack was happening.
An attacker can run code on a device. This can let them steal data, install harmful software, or get to private information. Researchers also showed they can run apps on a victim’s device.
The attack could work in both directions: a compromised presenter could target participants, while a malicious participant could target the presenter.
Three CVEs Assigned
The vulnerabilities discovered during the research are tracked as:
CVE-2026-53413: memory-corruption vulnerability allowing remote code execution.
CVE-2026-53414: an out-of-bounds memory-read vulnerability that can potentially expose sensitive memory contents.
CVE-2026-53415: a separate memory-corruption issue that can provide another potential path to remote code execution.
A Security rated the vulnerabilities with a CVSS 4.0 score of 9.0, calling them critical.
Zoom Released Security Fixes
A Security reported Zoom about the flaw on June 10, 2026, after finding a working zero-click exploit on June 9. Zoom accepted the report and later added protections on both the client and server sides.
Affected products included:
Zoom Workplace
Zoom Workplace VDI Client
Zoom Rooms
Zoom Meeting SDK
For Zoom Workplace, users need to update to version 7.1.5 or newer, or 7.0.6 or newer for the right branch. VDI Client users should update to 7.0.11 or 6.6.16. Zoom Rooms and Meeting SDK users need to update to 7.1.0 or newer.
Organizations need to quickly check Zoom versions on all company devices and update the systems used for important meetings first.
Security teams should think about limiting meeting access with waiting rooms, passcodes, and user verification. They can also turn off extra Zoom features like annotation, file transfer, whiteboarding, remote control, and third-party apps to lower the risk.
