High severity · published Oct 13, 2026
CVE-2026-108185
Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access
7.4
CVSS
0.2%
EPSS
No
On KEV
Description
Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZC
Zoom Clients · Zoom Communications
see references · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-108185
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-108185
www.zoom.com
https://www.zoom.com/en/trust/security-bulletin/zsb-26022
More from Zoom Clients
8.3
CVE-2026-53415
Zoom Clients - Use After Free
8.3
CVE-2026-53413
Zoom Clients - Buffer Over-write
7.4
CVE-2026-108184
Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access
7.0
CVE-2026-53410
Zoom Clients for Windows - Race Condition
6.5
CVE-2026-53414
Zoom Clients - Buffer Over-read