Back to Intelligence

Zoom Annotation Tool Flaws Enable Zero-Click Client Takeover: Detection, Patching, and Hardening Guide

SA
Security Arsenal Team
August 13, 2026
10 min read

Zoom has disclosed a set of serious vulnerabilities in its annotation feature — the tool that lets meeting participants draw, highlight, and type on a shared screen — that could allow any meeting participant to take over another attendee's Zoom client with zero interaction from the victim. No click, no download, no prompt, no visible indicator. The attack surface cuts in both directions: a person sharing their screen could compromise everyone watching, and anyone watching could compromise the presenter.

This is the worst possible class of collaboration-platform vulnerability. Zoom sits on virtually every corporate endpoint, runs with the user's full privileges, holds microphone and camera access, and routinely handles screen-shared content containing credentials, source code, legal documents, and regulated data. A zero-click client compromise inside a meeting is not just a vulnerability — it's a fully weaponizable initial-access primitive that requires nothing more than getting a target into a meeting, something phishing and calendar-invite social engineering accomplish trivially.

Defenders need to treat this with the urgency of an internet-facing RCE: verify client versions across the fleet today, deploy behavioral detections for Zoom client process abuse, and review meeting-security policy for externally hosted sessions.

Technical Analysis

Affected Component

The flaws reside in Zoom's annotation subsystem, which processes rendering commands exchanged between meeting participants when someone draws or types on a shared screen. Annotations are transmitted as structured data from participant to participant through the Zoom media pipeline — meaning every client in a meeting is parsing attacker-controllable input from every other client whenever screen sharing and annotation are active.

The critical defensive facts:

  • Zero user interaction required. The victim only needs to be present in the meeting. The malicious annotation data is processed automatically by the receiving client as part of normal rendering.
  • Bidirectional exploitation. Because annotation data flows from presenter to viewers and from viewers (annotating participants) back to the presenter, both roles are attackable. A malicious participant can target the host; a malicious or compromised host can target every attendee.
  • Client-side code execution. Successful exploitation yields code execution in the context of the Zoom client process, inheriting the logged-in user's privileges — including access to the microphone, camera, local files accessible to that user, and any credentials or tokens resident in memory.
  • No visual artifact. The exploitation occurs below the UI layer; nothing anomalous renders on screen for the victim to notice.

Attack Chain (Defender's View)

  1. Delivery: Attacker joins a meeting (open invite, compromised account, leaked meeting link, or social-engineered invitation to a target's own meeting) or convinces targets to join an attacker-hosted meeting.
  2. Trigger: Screen sharing begins. The attacker sends crafted annotation data through the normal meeting channel.
  3. Exploitation: The victim client's annotation parsing/rendering code processes the malformed input, resulting in memory corruption and attacker-controlled code execution inside the Zoom process.
  4. Post-exploitation: Attacker code runs under the user's context — typical follow-on behavior includes spawning a child process (PowerShell, cmd, rundll32, or an injected payload), establishing outbound C2, and harvesting credentials or meeting content.

Exploitation Status

At the time of disclosure, there are no confirmed reports of in-the-wild exploitation and the flaws were patched by Zoom in the August 2026 client updates. However, zero-click vulnerabilities in widely deployed collaboration clients are prime targets for both criminal initial-access brokers and nation-state operators — patch-diffing of collaboration clients is a mature discipline, and defenders should assume exploit development is underway now that the flaw class is public. Treat this as pre-exploitation urgent, not theoretical.

Note: Zoom's advisory does not publicly assign granular per-platform CVE identifiers in the coverage available at disclosure time. Track the official Zoom Security Bulletin for CVE assignments and exact fixed-version numbers as they are published, and validate against your specific platform builds (Windows, macOS, Linux, iOS, Android, and VDI clients may ship fixes on different schedules).

Detection & Response

Because exploitation happens inside the legitimate Zoom process, network and signature-based detection is weak. The highest-fidelity detection strategy is behavioral: the Zoom client (Zoom.exe, CptHost.exe on Windows; zoom.us on macOS) spawning child processes or making anomalous network connections is a strong post-exploitation signal, since legitimate Zoom behavior rarely involves process creation outside its own updater and crash-handler components.

Sigma Rules

YAML
---
title: Zoom Client Spawning Command Shell or Scripting Interpreter
id: 3f9a1b72-6c4d-4e85-b912-8a7d2c5f4e01
status: experimental
description: Detects the Zoom desktop client or its sharing host spawning cmd, PowerShell, wscript, cscript, mshta, or rundll32 — consistent with post-exploitation activity following a zero-click Zoom client compromise such as the August 2026 annotation flaws.
references:
  - https://thehackernews.com/2026/08/zoom-annotation-flaws-could-let-meeting.html
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Zoom.exe'
      - '\CptHost.exe'
      - '\ZoomSharingHost.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; Zoom does not legitimately spawn scripting interpreters in normal operation
level: high
---
title: Zoom Client Writing Executable Content to User-Writable Directories
id: 8c2e5d41-1f7a-4b93-a456-9e0b3d7c2a18
status: experimental
description: Detects the Zoom client process dropping executable files or scripts into user-writable locations such as AppData Local Temp, Downloads, or the user profile — a common payload-staging behavior after client-side exploitation.
references:
  - https://thehackernews.com/2026/08/zoom-annotation-flaws-could-let-meeting.html
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\Zoom.exe'
      - '\CptHost.exe'
      - '\ZoomSharingHost.exe'
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\Downloads\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.bat'
      - '.ps1'
      - '.vbs'
      - '.js'
  filter_known:
    TargetFilename|contains:
      - '\AppData\Roaming\Zoom\'
  condition: selection_image and selection_path and selection_ext and not filter_known
falsepositives:
  - Zoom updates staged outside the standard Zoom data directory (verify hash and signer)
level: medium
---
title: Zoom Client Process Establishing Connection to Rare External Host
id: 5b1d8f63-2a9c-4e77-b834-6f2a9c1d5e07
status: experimental
description: Detects the Zoom sharing/capture host process making outbound network connections to non-Zoom infrastructure. CptHost handles screen sharing and annotation rendering; connections to arbitrary external IPs may indicate C2 after exploitation.
references:
  - https://thehackernews.com/2026/08/zoom-annotation-flaws-could-let-meeting.html
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\CptHost.exe'
      - '\ZoomSharingHost.exe'
  filter_zoom:
    DestinationHostname|endswith:
      - '.zoom.us'
      - '.zoom.com'
      - '.zoomgov.com'
  filter_internal:
    DestinationIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.2'
      - '172.30.'
      - '172.31.'
  condition: selection and not filter_zoom and not filter_internal
falsepositives:
  - Zoom media servers on cloud provider IP space without reverse DNS
  - Third-party CDN endpoints used by Zoom in some regions
level: medium

Analyst note on fidelity: Rule 1 is the highest-fidelity and should be deployed broadly — Zoom spawning a scripting interpreter is almost never legitimate. Rule 3 will require tuning against your environment's observed Zoom CDN endpoints; build an allowlist of resolved Zoom media-server ranges from 30 days of baseline data before raising severity.

KQL Hunt (Microsoft Sentinel / Defender)

KQL — Microsoft Sentinel / Defender
// Hunt for Zoom client processes spawning suspicious child processes
// or making anomalous network connections — post-exploitation indicator
// for zero-click client compromise via the annotation feature
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "bitsadmin.exe", "certutil.exe"]);
let ZoomParents = dynamic(["zoom.exe", "cpthost.exe", "zoomsharinghost.exe", "zoom.exe\0"]);
union
(DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any (ZoomParents)
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, ReportId
),
(DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any (ZoomParents)
| where not(RemoteUrl has_any ("zoom.us", "zoom.com", "zoomgov.com"))
| where not(RemoteIP startswith "10." or RemoteIP startswith "192.168." or RemoteIP startswith "172.")
| summarize ConnectionCount = count(), RemoteEndpoints = make_set(RemoteIP, 20), RemoteUrls = make_set(RemoteUrl, 20) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
| where ConnectionCount > 0
)
| order by TimeGenerated desc

Velociraptor VQL

VQL — Velociraptor
-- Hunt for Zoom client processes with suspicious children or unsigned binaries
-- executing from Zoom's process tree across the fleet
SELECT Pid,
       Ppid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime,
       (SELECT Name FROM pslist(pid=Ppid)) AS ParentName
FROM pslist()
WHERE (ParentName =~ '(?i)(zoom|cpthost|zoomsharinghost)'
   AND Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|wmic|bitsadmin|certutil)')
   OR (Name =~ '(?i)(zoom|cpthost)'
   AND CommandLine =~ '(?i)(temp|downloads|public)')

Remediation

1. Patch All Zoom Clients Immediately

  • Update every Zoom Workplace desktop client (Windows, macOS, Linux) and mobile client to the August 2026 fixed release or later as specified in Zoom's security bulletin. Verify against the official advisory rather than assuming auto-update has covered the fleet — enterprise-managed devices frequently have auto-update disabled or deferred.
  • Do not forget VDI plugin clients, Zoom Rooms controllers, and SDK-embedded clients in custom applications. These commonly lag the main client by weeks and are frequently missed in patch sweeps.
  • Reference: Zoom Security Bulletin and the August 2026 coverage.

2. Verification Script

PowerShell
# Zoom Client Version Audit - Verify August 2026 patch deployment
# Run via RMM/Intune/SCCM across the fleet; flags endpoints running outdated Zoom clients

$MinSafeVersion = [version]"6.5.0"  # Replace with the exact fixed build from Zoom's advisory
$Results = @()

# Check per-machine and per-user Zoom installs
$ZoomPaths = @(
    "$env:ProgramFiles\Zoom\bin\Zoom.exe",
    "${env:ProgramFiles(x86)}\Zoom\bin\Zoom.exe"
)

# Enumerate per-user installs under AppData
Get-ChildItem "C:\Users" -Directory -ErrorAction SilentlyContinue | ForEach-Object {
    $UserZoom = Join-Path $_.FullName "AppData\Roaming\Zoom\bin\Zoom.exe"
    if (Test-Path $UserZoom) { $ZoomPaths += $UserZoom }
}

foreach ($Path in $ZoomPaths | Select-Object -Unique) {
    if (Test-Path $Path) {
        $FileVersion = (Get-Item $Path).VersionInfo.ProductVersion
        $Parsed = $null
        [version]::TryParse(($FileVersion -split ' ')[0], [ref]$Parsed) | Out-Null
        $Status = if ($Parsed -and $Parsed -ge $MinSafeVersion) { "PATCHED" } else { "VULNERABLE - UPDATE REQUIRED" }
        $Results += [PSCustomObject]@{
            Computer = $env:COMPUTERNAME
            Path     = $Path
            Version  = $FileVersion
            Status   = $Status
        }
    }
}

if ($Results.Count -eq 0) {
    Write-Output "[$env:COMPUTERNAME] No Zoom desktop client detected."
} else {
    $Results | Format-Table -AutoSize
    $Results | Export-Csv -Path "$env:TEMP\zoom_patch_audit_$env:COMPUTERNAME.csv" -NoTypeInformation
}

# Also audit installed-version registry entries for MSI-deployed clients
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
                 "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'Zoom' } |
    Select-Object DisplayName, DisplayVersion, InstallDate | Format-Table -AutoSize

3. Temporary Risk Reduction (Until Patching Completes)

  • Disable annotation where policy allows. In the Zoom admin console (Account Management → Account Settings → Meeting → In Meeting (Basic)), disable the Annotation and Whiteboard controls for the highest-risk populations until patch compliance is verified. This removes the vulnerable parsing path from untrusted input.
  • Restrict external meeting participation on unpatched endpoints: require waiting rooms, authenticated-users-only join, and host-controlled screen sharing ("Who can share: Host Only") to shrink the attacker-controlled input surface.
  • Block or alert on legacy Zoom client versions at the proxy/ZTNA layer so outdated clients cannot join meetings from managed networks.

4. Longer-Term Hardening

  • Enforce centralized Zoom client deployment (MSI/Intune/Jamf) with mandatory auto-update and a defined patch SLA — zero-click collaboration-client flaws warrant the same SLA tier as browser and OS updates.
  • Add Zoom client process trees to your EDR's behavioral monitoring scope explicitly; many deployments exclude collaboration tools from aggressive child-process blocking due to false-positive fear. Revisit that exclusion.
  • Include "malicious meeting participant" in tabletop and purple-team scenarios — this disclosure proves the collaboration layer is a real initial-access vector, and most IR plans do not cover it.

The Bigger Picture

This is the latest evidence that collaboration clients are the new browser from an attack-surface perspective: universally installed, richly privileged (camera, mic, screen content), parsing complex attacker-controlled data formats from arbitrary remote parties, and historically under-monitored by defenders. Zero-click flaws in meeting platforms will keep appearing. The organizations that fare best will be the ones that patch collaboration software on browser-like cadence and watch its process behavior like they watch Office and Chrome.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub

sigma-rulekql-detectionthreat-huntingdetection-engineeringsiem-detectionzoomzero-clickremote-code-executionvulnerability-managementvideo-conferencing-security

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action