Zoom Discloses High-Severity Vulnerability in My Notes Feature (CVE-2026-108185)
Zoom has revealed a high-severity vulnerability (CVE-2026-108185) in the My Notes feature of its Workplace clients, affecting Windows, macOS, Linux, Android, and iOS. The flaw, disclosed on October 13, 2026, could allow an unauthenticated attacker with network access to expose sensitive information due to improper certificate validation.
With a CVSS score of 7.4, the vulnerability requires high attack complexity but no user privileges or interaction. While it poses significant risks to confidentiality and integrity, it does not impact system availability. Zoom’s advisory clarifies that the issue is limited to the My Notes feature, not all communication channels, and does not enable attackers to intercept meetings, steal credentials, or compromise devices.
Affected Versions & Fixes
- Windows: Versions 7.1.5 to 7.1.8 (fixed in 7.1.9 and 7.2.0).
- macOS & Linux: Versions 7.0.5 to 7.1.8 (fixed in 7.2.0).
- Android & iOS: Versions 7.0.5 to 7.1.9 (fixed in 7.2.0).
The advisory excludes Zoom Rooms, browser access, and other Zoom products. Zoom’s Offensive Security team discovered the flaw internally, though no active exploitation or technical details have been confirmed. Organizations are advised to update affected clients to the latest fixed versions.
Source: https://gbhackers.com/zoom-certificate-validation-vulnerability/
Zoom TPRM report: https://www.rankiteo.com/company/zoom
"id": "zoo1791973808",
"linkid": "zoom",
"type": "Vulnerability",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Technology (Video Conferencing)',
'name': 'Zoom Video Communications, Inc.',
'type': 'Company'}],
'attack_vector': 'Network',
'customer_advisories': 'Organizations advised to update affected clients',
'data_breach': {'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Sensitive information'},
'date_publicly_disclosed': '2026-10-13',
'description': 'Zoom has revealed a high-severity vulnerability '
'(CVE-2026-108185) in the My Notes feature of its Workplace '
'clients, affecting Windows, macOS, Linux, Android, and iOS. '
'The flaw could allow an unauthenticated attacker with network '
'access to expose sensitive information due to improper '
'certificate validation.',
'impact': {'data_compromised': 'Sensitive information',
'systems_affected': 'Zoom Workplace clients (Windows, macOS, '
'Linux, Android, iOS)'},
'investigation_status': 'Vulnerability disclosed, no active exploitation '
'confirmed',
'post_incident_analysis': {'corrective_actions': 'Patch released for affected '
'versions',
'root_causes': 'Improper certificate validation in '
'My Notes feature'},
'recommendations': 'Update affected Zoom Workplace clients to the latest '
'fixed versions (7.1.9, 7.2.0).',
'references': [{'source': 'Zoom Advisory'}],
'response': {'communication_strategy': 'Public advisory issued',
'containment_measures': 'Update affected clients to fixed '
'versions (7.1.9, 7.2.0)',
'remediation_measures': 'Released patches for affected versions'},
'title': 'Zoom Discloses High-Severity Vulnerability in My Notes Feature '
'(CVE-2026-108185)',
'type': 'Information Disclosure',
'vulnerability_exploited': 'Improper certificate validation (CVE-2026-108185)'}