# Zoom Flaws Risk Sensitive Data Exposure via Network Access

*Published October 14, 2026*
*Source: [https://cybersecuritynews.com/zoom-certificate-validation-flaw/](https://cybersecuritynews.com/zoom-certificate-validation-flaw/)*

## Executive Summary

Zoom has identified two certificate validation flaws, CVE-2026-108184 and CVE-2026-108185, which could expose sensitive information over a network. Affected users must update their Zoom clients to mitigate these high-severity risks.

## Article

Two significant security flaws in Zoom clients could potentially allow unauthorized network access to sensitive information. These vulnerabilities, identified as CVE-2026-108184 and CVE-2026-108185, impact Windows clients and the My Notes feature on both desktop and mobile platforms. With a CVSS score of 7.4, these issues require immediate attention from both individual users and businesses to ensure data protection. Although the specific nature of the data at risk has not been disclosed, the flaws involve improper certificate validation, which may let an attacker impersonate trusted systems or disrupt secure communications.

The vulnerabilities stem from certificate validation failures. When certificate checks are compromised, software may accept connections that should be rejected, posing a risk of information disclosure. Zoom has outlined the affected versions in its security bulletins. For CVE-2026-108184, the affected Windows Workplace versions start at 7.0.0, with updates required to versions 7.2.0 or 7.1.9. The Zoom Workplace VDI Client for Windows is vulnerable from version 7.0.11 to before 7.0.13, while Zoom Rooms for Windows is affected from version 7.0.0 to before 7.1.7.

CVE-2026-108185 impacts the My Notes feature, with vulnerabilities beginning at version 7.1.5 on Windows and 7.0.5 on macOS, Linux, Android, and iOS. Updates to versions 7.2.0 or 7.1.9 are necessary to mitigate the risk. Users should ensure the latest versions of Zoom are installed via the official Download Center to receive important security fixes.

Administrators in managed environments should conduct a thorough review and update of all installations, including those outside the main office. This process should encompass all related Zoom applications to ensure comprehensive protection against these vulnerabilities.