CVE-2026-53418

Status: Awaiting AnalysisHigh (8.1)—

Severity8.1High · CVSS 3.1

Exploitation probability0.24 %higher than 14% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access.

CVSS

Base score: 8.1
Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.24 %
Percentile among all scored CVEs: 14
Score date: 10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1210 Exploitation of Remote Serviceslateral movement85 %
Primary impactT1005 Data from Local Systemcollection55 %
Secondary impactT1565 Data Manipulationimpact45 %

Vector AV:N/PR:L/UI:N (red con privilegios bajos → T1210) y C:H/I:H; el texto habla de usuario no autenticado, contradictorio con PR:L. Impactos inferidos de C:H e I:H, no explícitos.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Network Segmentation Vulnerability Scanning Threat Intelligence Program Restrict File and Directory Permissions Privileged Account Management Remote Data Storage

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Zoom — Workplace FOR Android^AI

CWEs

CWE-939

References

Show 1 references

https://www.zoom.com/en/trust/security-bulletin/zsb-26019

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-53418",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-53418",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-13T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@zoom.us",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@zoom.us",
      "affectedData": [
        {
          "vendor": "Zoom Communications",
          "product": "Zoom Workplace",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "7.2.1",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Android"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-13T15:17:44.630",
  "references": [
    {
      "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-26019",
      "source": "security@zoom.us"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@zoom.us",
      "description": [
        {
          "lang": "en",
          "value": "CWE-939"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access."
    }
  ],
  "lastModified": "2026-10-14T04:18:23.150",
  "sourceIdentifier": "security@zoom.us"
}