Zoom Workplace high-severity fixes (ZSB-26019 to 26022): update your home app
On October 13, 2026 Zoom published four High security bulletins for Zoom Workplace clients. How home users update on Windows, Mac, Linux, Android, and iOS, and which versions to verify.
If you use the Zoom Workplace app for family calls, school meetings, or club meetings, check the version this week. On October 13, 2026, Zoom published four High severity security bulletins (ZSB-26019, ZSB-26020, ZSB-26021, and ZSB-26022). Zoom’s advice on each page is the same: apply the latest updates from zoom.us/download (or your phone’s app store).
You do not need to memorize CVE numerology. You need a fixed build running on the computers and phones where you actually join meetings.
What Zoom disclosed
All four bulletins landed the same day. Severity is High on each.
| Bulletin | CVE | Short version | Who it hits |
|---|---|---|---|
| ZSB-26019 | CVE-2026-53418 | Improper authorization in a custom URL scheme handler (CVSS 8.1) | Zoom Workplace for Android before 7.2.1 |
| ZSB-26020 | CVE-2026-53420 | Buffer overflow in a Zoom Phone feature (CVSS 8.0) | Zoom Workplace on all supported platforms before 7.2.0 |
| ZSB-26021 | CVE-2026-108184 | Improper certificate validation (CVSS 7.4) | Certain Windows Workplace, VDI, and Rooms clients before the fixed branch builds |
| ZSB-26022 | CVE-2026-108185 | Improper certificate validation in My Notes (CVSS 7.4) | Workplace on Windows, macOS, Linux, Android, and iOS in the stated version ranges |
Zoom’s bulletin text is careful: the certificate issues may allow an unauthenticated user to conduct information disclosure via network access. The Android URL-scheme issue and the Zoom Phone buffer overflow are framed as escalation of privilege via network access. Zoom has not published exploit details. Patching is the job.
For everyday home installs, the practical targets are:
- Desktop (Windows, Mac, Linux): get to 7.2.0 or newer. The certificate bulletins also name fixed 7.1.9 branch builds, but ZSB-26020 (Zoom Phone buffer overflow) lists only 7.2.0 as the fix for all platforms, so 7.1.9 is not enough
- Android: get to at least 7.2.1 so you clear both the My Notes certificate fix (7.2.0) and the URL-scheme fix (7.2.1)
- iOS: get to 7.2.0 or newer for the My Notes certificate fix, then stay current afterward
Rooms and VDI clients have their own floors in ZSB-26021 (Rooms for Windows 7.1.7, VDI Client for Windows 7.0.13). Most home users never install those. If you do, update those apps separately.
How to update and verify on your own devices
Windows, Mac, or Linux desktop
- Open the Zoom Workplace app.
- Check the version:
- Windows / Linux: profile picture or avatar menu → Help → About Zoom (wording can vary slightly by build).
- Mac: Zoom menu → About Zoom.
- If you are below 7.2.0, update:
- Prefer in-app update if Zoom offers it.
- Or download a fresh installer from zoom.us/download, install, and relaunch.
- Fully quit Zoom (every window), open it again, and re-check About.
- Confirm you are on 7.2.0 or newer.
Android phone or tablet
- Open Google Play, search for Zoom Workplace / Zoom, and update.
- Open the app once so the new build actually launches.
- Check Settings → About (or the in-app About screen) and confirm you are on 7.2.1 or newer.
Android is the strictest home target in this batch. 7.2.0 is not enough for ZSB-26019.
iPhone or iPad
- Open the App Store, update Zoom.
- Open the app once.
- Confirm 7.2.0 or newer in the in-app About screen.
Why “auto update” still needs a version check
Zoom can stage updates. A laptop that stays asleep for days may still be on an old build. A phone that never opens the Play Store can sit behind. Opening About is the receipt, the same way edge://version or brave://version is for browsers.
If you only join meetings in a browser tab and never installed the Zoom app, these client bulletins do not apply the same way. Most people who “use Zoom” have the app. Check anyway on the devices you trust for video calls.
Do this / don’t do that
Do
- Update Zoom Workplace on every home computer and phone where you join meetings.
- On Android, verify 7.2.1+. On desktop, verify 7.2.0+. On iOS, verify 7.2.0+.
- Fully quit and relaunch after an update so the old process is gone.
- Prefer zoom.us/download or the official app stores. Skip random “Zoom installer” sites.
Don’t
- Do not stop at 7.2.0 on Android and call the whole set done. You still need 7.2.1 for ZSB-26019.
- Do not panic. Zoom’s bulletins do not say any of these bugs are under active attack.
- Do not confuse desktop, Android, iOS, Rooms, and VDI. Each has its own version line.
Bottom line
Zoom’s October 13, 2026 High bulletins (ZSB-26019 through ZSB-26022) are a home-app update day, not an enterprise ticket. On your own devices: update Zoom Workplace from zoom.us/download or the store, relaunch, and confirm 7.2.0+ on desktop and iOS, and 7.2.1+ on Android. That is the whole job.
Image: Zoom Workplace social image (zoom.com).
