Splunk and Zoom Fix Security Flaws That Could Let Hackers Take Over Accounts
Both companies pushed out patches this week. One Zoom flaw scores a near-perfect danger rating and could let a criminal break into accounts without knowing a password.
Key points
- Zoom patched CVE-2026-53412, a critical flaw scoring 9.8 out of 10, affecting Zoom Workplace for Windows.
- That flaw could let a criminal seize a user's Zoom account with no password and no action required from the victim.
- Splunk fixed three product-specific flaws, including two high-severity bugs, all resolved in versions 10.4.1, 10.2.5, 10.0.8 and 9.4.13.
- Neither company has reported these vulnerabilities being used in active attacks.
Zoom and Splunk both released security updates this week, closing holes that could allow criminals to hijack accounts or steal stored passwords.
Zoom's fix is the more urgent. The company patched a critical vulnerability, tracked as CVE-2026-53412, in its Zoom Workplace and Zoom Workplace VDI Client (a version built for shared corporate desktops) on Windows. It carries a CVSS score of 9.8 out of 10, where 10 is the worst possible on that standardised danger-rating scale. We first flagged this CVE on 15 July in our earlier report on the same Windows flaw.
Could a criminal take over your Zoom account without your password?
Yes. An attacker operating remotely, with no credentials at all, could exploit this bug to seize control of an affected account. Zoom hasn't said how many users were exposed, and it hasn't reported any real-world attacks.
Zoom's update bundle also covers three high-severity bugs. One is a TOCTOU race condition, where a program checks whether an action is safe and then briefly loses control before completing it, leaving a gap an attacker can exploit. The other two let attackers raise their own permission level once they've gained limited access to a system.
If you're running Zoom on Windows, confirm it has updated. Zoom typically pushes updates automatically, but a quick check takes seconds.
Should you worry about the Splunk flaws?
Splunk, which makes software organisations use to search and monitor their IT logs, patched three product-specific flaws. CVE-2026-20296 is a high-severity bypass of command safeguards: get past it and an attacker can run instructions the software should have blocked. CVE-2026-20297 is a high-severity path traversal, a technique where the software is tricked into writing files to folders it shouldn't touch. CVE-2026-20298 is a medium-severity flaw that exposes stored credential hashes, scrambled password representations that can sometimes be cracked offline.
All three are resolved in the 10.4.1, 10.2.5, 10.0.8 and 9.4.13 releases, which also cover critical and high-severity bugs in bundled libraries such as Golang and OpenSSL.
As SecurityWeek first reported, neither company has seen these flaws exploited. That window between patch announcement and active criminal use can close within days, though, so IT teams running either product shouldn't treat these as routine.
Ask your IT contact whether the latest Splunk and Zoom versions are already deployed.
