CVE-2026-108185: Zoom Workplace improper certificate validation in My Notes

CVE-2026-108185 · Severity: high · CVSS 7.4 · Published 2026-10-13

Zoom Workplace clients contain an improper certificate validation flaw in the My Notes feature that could allow an attacker to intercept and disclose sensitive information transmitted over the network without needing to authenticate. An attacker could potentially eavesdrop on notes content or other data exchanged through this feature by conducting a man-in-the-middle attack.

Technologies: Zoom Workplace for Windows. Vendors: Zoom.

Quick answers

Is CVE-2026-108185 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-108185 being exploited in the wild.
How severe is CVE-2026-108185?
High severity, with a CVSS score of 7.4, published 13 October 2026.
Which products and versions are affected?
Zoom Workplace for Android 7.0.5 to before 7.2.0; Zoom Workplace for iOS 7.0.5 to before 7.2.0; Zoom Workplace for Linux 7.0.5 to before 7.1.9 and 7.2.0; Zoom Workplace for macOS 7.0.5 to before 7.1.9 and 7.2.0; and 1 more.
Is there a fix for CVE-2026-108185?
Yes: fixed in Zoom Workplace for Windows 7.1.9 and 7.2.0; Zoom Workplace for macOS 7.1.9 and 7.2.0; Zoom Workplace for Linux 7.1.9 and 7.2.0; Zoom Workplace for Android 7.2.0; Zoom Workplace for iOS 7.2.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108185 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-108185?
Check whether you run Zoom Workplace for Android, Zoom Workplace for iOS, Zoom Workplace for Linux or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Zoom Workplace for Windows 7.1.9 and 7.2.0; Zoom Workplace for macOS 7.1.9 and 7.2.0; Zoom Workplace for Linux 7.1.9 and 7.2.0; Zoom Workplace for Android 7.2.0; Zoom Workplace for iOS 7.2.0

Technical details

The vulnerability stems from improper certificate validation in the My Notes feature of Zoom Workplace clients across multiple platforms. An unauthenticated attacker with network access can exploit this via a man-in-the-middle attack to intercept and access sensitive information. The flaw allows an attacker to conduct information disclosure without requiring authentication or user interaction.

Affected products

  • Zoom Workplace for Windows 7.1.5 to before 7.1.9 and 7.2.0
  • Zoom Workplace for macOS 7.0.5 to before 7.1.9 and 7.2.0
  • Zoom Workplace for Linux 7.0.5 to before 7.1.9 and 7.2.0
  • Zoom Workplace for Android 7.0.5 to before 7.2.0
  • Zoom Workplace for iOS 7.0.5 to before 7.2.0

Timeline

  • 2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.