🔴 Critical | Source: The Hacker News
A vulnerability in Zoom’s annotation feature allowed any meeting participant to silently take over the Zoom client of other attendees — including the presenter — without requiring any interaction from the victim. The flaw required no clicks, downloads, or prompts, meaning simply being present in a meeting was sufficient for exploitation. This represents a significant zero-interaction attack surface for any organisation using Zoom for internal or external meetings.
Security Architect’s Take: Ensure Zoom clients are patched to the latest version across your estate immediately, and consider enforcing this via your MDM or endpoint management tooling. In the interim, review whether annotation features can be disabled by default via Zoom admin controls for your organisation’s account.
Original advisory: Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee’s Client