InfoSecBulletin Cybersecurity for mankind
A new set of flaws in Zoom’s software can let hackers take control of systems. Zoom has launched security updates to fix three different flaws in its Windows and iOS apps.
The most serious of these flaws lets authorized attackers gain higher system powers, changing a regular user account into a major administrative risk.
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Zoom Rooms and Workplace Flaws
The first issue affects Zoom Rooms for Windows. Known as CVE-2026-30906, this serious flaw has a CVSS score of 7.8 out of 10. The flaw comes from a weak point in the software’s installer. If someone already has normal access to a computer, they can use this flaw to gain higher access.
Hackers often use this access to disable security tools, steal important company data, or install ransomware. This weakness affects all versions of Zoom Rooms for Windows before 7.0.0.
Security researcher “sim0nsecurity” discovered a second high-severity bug in the Zoom Workplace VDI Plugin for Windows.
This flaw is dubbed CVE-2026-30905 and has a CVSS score of 7.8. It happens because a file name or path is controlled externally in the software’s Windows Universal Installer.
This Zoom Rooms bug allows a local user with permission to start a privilege escalation attack. It affects the Zoom Workplace VDI Plugin version 6.6.10 and needs a quick update to version 6.6.11 or later.
While Windows systems have the highest risks, mobile users are also impacted by these updates. Zoom Workplace on iOS has a less serious problem known as CVE-2026-30904.
This issue involves a failure of a protection mechanism that could lead to unauthorized information disclosure.
With a CVSS score of 1.8, the risk is low right now because the attacker needs to physically access the target’s iOS device.
However, it still represents a frustrating privacy breach for affected users. Security researcher “errorsec_” reported this flaw, which affects all iOS app versions older than 7.0.0.
Zoom strongly encourages all users, IT admins, and remote workers to install the latest security updates right away. Users can protect their devices by getting the newest, updated software from the official Zoom download center.
