Executive brief
Zoom Rooms for Windows, a software solution for managing conference room hardware and meetings, contains a security flaw that allows a user with existing low-level access to the computer to gain higher administrative privileges. This could allow an unauthorized person to take full control of the conference room system, potentially leading to the theft of sensitive data or disruption of meeting operations. Organizations should update their Zoom Rooms installations to version 7.1.0 or later to resolve this issue.
Technical details
An improper privilege management vulnerability exists in Zoom Rooms for Windows prior to version 7.1.0. The flaw, categorized under CWE-20 (Improper Input Validation) by the vendor, allows an authenticated user with local access to the host machine to escalate their privileges. By exploiting this vulnerability, an attacker can achieve full confidentiality, integrity, and availability impact on the affected system. The attack requires local access but no user interaction. The issue is resolved in Zoom Rooms for Windows version 7.1.0.
Affected products
- Zoom Communications Zoom Rooms before 7.1.0
Timeline
- 2026-07-14: advisory: Initial publication by Zoom (ZSB-26011)
- 2026-07-16: disclosed: NVD publication date