CVE-2026-53407 is an improper authorization flaw (CWE-939) in the custom URL scheme handler of Zoom Workplace for Android before 7.0.4 and iOS before 7.0.3, scored 8.1 high. Update the app on every managed phone and tablet, and update the Meeting SDK if you embed it.
What's affected
From Zoom bulletin ZSB-26010: Zoom Workplace for Android before 7.0.4 and for iOS before 7.0.3. The bulletin also lists the Zoom Meeting SDK for Android before 7.0.4 and for iOS before 7.0.3.
The bulletin covers CVE-2026-53407 and CVE-2026-53408 together and was first published on 9 June 2026. It scores the issue 8.1 with no privileges required and user interaction required, while the NVD record shows low privileges and no interaction, so the two sources differ on the vector.
How to check if you're exposed
On Android, open Settings, Apps, Zoom Workplace and read the version. On iOS, open the App Store listing or Settings, General, iPhone Storage. Compare with 7.0.4 on Android and 7.0.3 on iOS.
For mobile device management, filter your app inventory by Zoom and its version. If your own apps embed the Meeting SDK, read the SDK version in your build files.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Find managed devices that run Zoom Workplace and list their version.
- Update Android devices to 7.0.4 or later and iOS devices to 7.0.3 or later.
- Rebuild and release apps that embed the Meeting SDK with a fixed SDK version.
- Enforce a minimum app version in your mobile device management policy.
- Tell employees who use personal devices to update from the app store.
Why it matters
A custom URL scheme lets other apps and web pages open an app with a link. The handler must decide whether the request is allowed, and the bulletin says this one did not check authorization correctly (CWE-939, improper authorization in handler for custom URL scheme).
The bulletin gives no further technical detail, so avoid guessing at the mechanism. Mobile apps update slowly outside managed fleets, which is the practical risk here. The record does not report exploitation and it is not in the CISA KEV catalog.
Quick check
Does this affect the desktop client?
The bulletin lists the Android and iOS apps and the Meeting SDK for those platforms.
Why do the two scores disagree?
The bulletin and NVD record use different vector strings. Both rate it high.
Sources
Last reviewed: 19 October 2026.
