Zoomsday: What We Found In Our Customers' Zoom Configurations

In August 2026, researchers at A Security disclosed what they call the Zoomsday chain: three vulnerabilities in Zoom's screen-share annotation feature, tracked as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415. Chained together, they let a participant in a Zoom meeting silently take over another attendee's device, or let a presenter take over everyone watching. No click, download, or approval prompt required. 

‍

We checked our own customer base against it and the number of affected customers was higher than we expected.

‍

What the bug did

‍

Zoom's annotation feature lets participants draw, highlight, and add text on a shared screen. To make that work, Zoom runs a proprietary protocol that opens a direct channel between whoever is sharing their screen and everyone viewing it. The chain runs through three separate memory-safety bugs in how that protocol handles annotation data. CVE-2026-53413 is a buffer over-write (CVSS 8.3) in the routine that processes formatting data, in a function called CAnnoFormatBlock::Deserialize. CVE-2026-53414 is a related buffer over-read (CVSS 6.5). CVE-2026-53415 is a use-after-free (CVSS 8.3) that researchers chained with the other two to gain code execution. In a proof of concept on macOS, researchers used the bug to silently launch Safari on a target's machine with no warning and no visible sign anything had happened.

‍

The flaws affected Zoom clients across Windows, macOS, Linux, iOS, and Android. Zoom covered the three in bulletins ZSB-26015, ZSB-26016, and ZSB-26017, and has shipped patches across supported platforms and release branches.

‍

The deeper issue at play

‍

A Security found and weaponized this chain in about 24 hours, using fewer than 20 prompts to a publicly available AI model. The firm's cofounder, Omer Gull, put the shift in blunt terms: work that used to take a team of five people roughly six months now takes a small team an afternoon.

‍

Zoom's annotation protocol has been running in production for years without anyone noticing this. It's a stark example of how fast the floor moves now. The same AI capability that compresses vulnerability research from months to hours cuts both ways: attackers get faster, and so do defenders who build their detection pipeline the same way. We built ours that way. Our posture-check research team uses AI-assisted analysis internally, which is part of why we could ship coverage for this within days of public disclosure instead of weeks.

‍

What we found in our own data

‍

We ran our customer base against the vulnerable Zoom builds. 55% of Zoom users across our U.S. customer base were running a version exposed to Zoomsday. Exposure per tenant ranged from 10% to 100% of users. This wasn't a niche configuration issue. Most organizations run Zoom, and most organizations hadn't gotten to this patch yet.

‍

Reco’s response

‍

Within days of disclosure, our security research team released:

• Six new posture checks that flag unpatched or vulnerable Zoom configurations.
• Two alerts for risky setting changes that reopen the attack surface, specifically annotation being re-enabled or screen-share permissions being widened to all participants.
• Branch-aware version comparison, rather than a flat "is this version old" check. Zoom ships patches across multiple release branches, and a naive version check flags clients that are already safe. Our branch-aware logic cut false positives by 6,044 users compared to that naive approach.

That last point particularly matters because a posture check that floods your team with false alarms gets ignored within a week. One that tells you exactly which of your 32,902 users are actually exposed gets acted on.

‍

The takeaway

‍

Zoomsday is a Zoom story on the surface. Underneath, it's a story we’re telling more and more often about the shrinking gap between a vulnerability being found and it being exploited at scale. It’s about whether your security tooling can keep pace with that gap. AI cut the time to find this chain of bugs from months to hours. It should also be cutting the time it takes you to know you're exposed.

‍

If you're a Reco customer, check your Zoom posture dashboard for the Zoomsday checks now live in your environment. If you're not yet a customer and want to see what your own exposure looks like, reach out and we'll walk you through it.