Fewer Than 20 AI Prompts Uncover Critical Zoom Flaws

Zoom’s real-time annotation system lets participants draw, type and place shapes on shared screens or whiteboards, with native clients automatically parsing messages carried by a proprietary protocol. That design turned a collaboration tool into a cross-platform attack surface: a malicious attendee or host could trigger zero-click remote code execution without any action or warning to the victim. A Security said Zoom is used by 70% of Fortune 100 companies, raising the risk that a compromised meeting could expose credentials, cameras, microphones and wider corporate networks.

A Security found the memory-corruption flaws on June 8, 2026, using publicly available AI models and fewer than 20 prompts, and built a working exploit in under 24 hours. It confirmed remote code execution against Zoom Client 7.0.5 across platforms on June 9 and reported the issue on June 10. Zoom shipped version 7.1.0 on June 22, added a server-side mitigation on July 15, and released version 7.1.5 on July 20. Publicly disclosed on August 11, the three bugs are CVE-2026-53413, CVE-2026-53414 and CVE-2026-53415, each rated 9.0 under CVSS 4.0.