Critical Zoom Flaw Could Let Attackers Take Over Windows Accounts

Zoom released patches for a critical Windows vulnerability (CVE-2026-53412, CVSS 9.8) that could allow an unauthenticated attacker to take over accounts remotely, plus three high-severity local privilege escalation flaws affecting installers, Zoom Rooms, and the VDI plugin; there is no evidence of active exploitation, and organizations are urged to inventory Zoom components, apply updates, enforce MFA, and monitor for suspicious activity.