CVE-2026-108184

Executive Summary

CVE-2026-108184 is an improper certificate validation vulnerability (CWE-295) affecting certain Zoom Clients for Windows. It allows an unauthenticated attacker with network access to conduct information disclosure by exploiting weak or absent validation of TLS certificates. With a CVSS 3.1 base score of 7.4, the flaw carries high confidentiality and integrity impact, though exploitation is rated as requiring high attack complexity.

Technical Analysis

The vulnerability resides in the certificate validation logic implemented by Zoom Clients for Windows. CWE-295 (Improper Certificate Validation) means the client either fails to validate the certificate chain of a remote peer, accepts certificates signed by untrusted CAs, ignores hostname mismatch errors, or fails to check certificate revocation. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates the attack is network-accessible, does not require authentication or user interaction, and succeeds only under conditions characterized as "high complexity" — for example, requiring the attacker to be positioned to intercept or redirect client traffic.

The CNA title and NVD description do not disclose specific functions, modules, endpoints, or certificate-PIN implementations. Accordingly, no code-level function names or file paths are asserted here. At the class level, a client failing to properly validate server certificates is susceptible to man-in-the-middle (MITM) positioning, allowing an adversary to present a forged, self-signed, or expired certificate that the client accepts without error. The high confidentiality/integrity impact (C:H/I:H) suggests accepted forged sessions can leak or modify data exchanged over the affected channel. Availability is unaffected (A:N), consistent with an interception/data-manipulation class flaw rather than a denial-of-service issue.

The attack surface is the Zoom Windows client's network communication stack, including any TLS-protected connections the client initiates or accepts. Because the flaw is in client-side validation, the upstream Zoom service does not need to be compromised; only the client's trust decision does.

Exploitation Scenarios

No public PoC or exploit code exists for this CVE. The following chain is inferred strictly from the vulnerability class (improper certificate validation).

1. Reconnaissance / target identification. An attacker identifies a Windows host running an affected Zoom client and determines a network path by which the client's TLS-protected traffic can be intercepted. This could be a hostile or compromised local network segment, a rogue Wi-Fi access point, or any actor capable of traffic redirection (e.g., DNS or route manipulation) between the client and its legitimate peer. The CVSS AC:H rating reflects the positioning and/or conditions required to reach that path.

2. Trigger of the flaw class. The attacker presents a certificate that a correctly validating client would reject — for example, a self-signed certificate, a certificate with a mismatched subject or hostname, an expired certificate, or one issued by an untrusted CA. Because CVE-2026-108184 is an improper certificate validation issue, the affected client proceeds with the connection rather than aborting it, meaning the trust failure is silently accepted. No authentication (PR:N) and no user interaction (UI:N) are required.

3. Payload / execution method at the vulnerability-class level. The attacker terminates the intercepted TLS session, completing the MITM. No specific injected payload syntax, endpoint path, or parameter is described in the available data; the exploitation primitive is the accepted forged certificate itself. The attacker can then observe and potentially alter the data traversing the channel in a way the client believes is protected.

4. Post-exploitation impact. Consistent with C:H/I:H, the attacker gains access to confidential information exchanged by the client and can influence the integrity of that exchange. Data confidentiality and integrity of the affected channel are compromised. Availability is not impacted. No post-exploitation behavior (persistence, lateral movement) is described in the source data.

Impact Assessment

Exploitation yields high confidentiality (C:H) and high integrity (I:H) impact with no availability (A:N) impact. Scope is unchanged (S:U), meaning the vulnerable client component and the impacted data are within the same security authority — the compromise does not inherently escalate to other components. Exploitation requires no privileges (PR:N) and no user interaction (UI:N), but attack complexity is high (AC:H), constraining exploitation to attackers capable of network interception or redirection.

The business blast radius is limited to organizations running affected Zoom Clients for Windows over networks subject to interception. Realistic scenarios include remote/hybrid workers on untrusted networks, travel or public Wi-Fi use, and any environment where an adversary can position on the path. Sensitive meeting content, credentials, or data carried over affected client connections could be exposed or manipulated. No affected version range was provided, so affected fleet scope cannot be precisely enumerated from source data. The EPSS score has not yet been assigned by FIRST.org and no EPSS value should be cited. CVE-2026-108184 is not listed in CISA KEV, and there is no evidence of active exploitation in the wild.

Detection Guidance

Sigma Rule

title: Potential MITM via Improper Certificate Validation in Zoom Windows Client
id: 3f9a7c21-1b4e-4d8a-9c2f-zoomcve108184
status: experimental
description: Detects network connection events consistent with the Zoom Windows client connecting to untrusted or non-Zoom certificate infrastructure, indicative of CVE-2026-108184 exploitation (improper certificate validation).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108184
author: valtersit.com
date: 2026/01/01
logsource:
  category: network_connection
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\Zoom.exe'
      - '\ZoomOutlookPlugin.exe'
  selection_dest:
    DestinationPort:
      - 443
      - 8801
  filter_known:
    DestinationHostname|endswith:
      - '.zoom.us'
      - '.zoom.com'
  condition: selection_proc and selection_dest and not filter_known
falsepositives:
  - Legitimate Zoom client connections to regional or CDN endpoints not covered by filter_known
  - Corporate proxy or SSL inspection infrastructure
level: medium
tags:
  - attack.t1190
  - cve.2026.108184

YARA Rule

rule CVE_2026_108184_Zoom_Improper_Cert_Validation
{
    meta:
        description = "Heuristic detection for artifacts related to improper certificate validation in Zoom Clients for Windows (CVE-2026-108184). Targets binaries referencing Zoom and certificate validation APIs. High false-positive potential; use for hunting only."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108184"
        date = "2026-01-01"
        severity = "high"

    strings:
        $zoom = "Zoom" ascii wide nocase
        $zbin = "Zoom.exe" ascii wide
        $cv1 = "CertVerifyCertificateChainPolicy" ascii
        $cv2 = "WinVerifyTrust" ascii
        $cv3 = "CertGetCertificateChain" ascii
        $susp1 = "-----BEGIN CERTIFICATE-----" ascii
        $susp2 = "self-signed" ascii nocase

    condition:
        (
            uint16(0) == 0x5A4D and
            $zoom and
            (
                ($zbin and 1 of ($cv*)) or
                (2 of ($cv*) and any of ($susp*))
            )
        )
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET [443,8801] (msg:"CVE-2026-108184 Possible Zoom Windows Client TLS Connection to Untrusted Endpoint"; flow:established,to_server; tls.store; content:"|16 03|"; depth:2; tls_sni; pcre:"/^(?!.*\.zoom\.(us|com)$)/i"; threshold:type limit, track by_src, count 5, seconds 60; classtype:policy-violation; reference:cve,2026-108184; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-108184; sid:10818401; rev:1;)

Elastic Detection

network where process.name : ("Zoom.exe", "ZoomOutlookPlugin.exe") and
  event.action == "connection_attempted" and
  destination.port in (443, 8801) and
  not endsWith~(destination.domain, ".zoom.us") and
  not endsWith~(destination.domain, ".zoom.com")

Splunk SPL Query

index=network sourcetype=pan:traffic OR sourcetype=zeek:conn
| search (process_name="Zoom.exe" OR process_name="ZoomOutlookPlugin.exe")
| where dest_port IN (443, 8801)
| eval zoom_dest=if(like(dest_host, "%.zoom.us") OR like(dest_host, "%.zoom.com"), "trusted", "untrusted")
| where zoom_dest="untrusted"
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_host) as destinations by src_ip, process_name
| where count > 3

Wazuh OSSEC Rule

<group name="zoom,cve-2026-108184,">
  <rule id="108184" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">Zoom\.exe|ZoomOutlookPlugin\.exe</field>
    <field name="destination.port">443|8801</field>
    <field name="destination.domain" negate="yes">^.*\.zoom\.(us|com)$</field>
    <description>CVE-2026-108184: Zoom Windows client connecting to untrusted endpoint - possible certificate validation bypass / MITM.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>network,pci_dss_10.6.1,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, workaround, or affected-version data is available in any tracked source. CVE-2026-108184 is not in CISA KEV and has no known public exploit or PoC.

1. Immediate mitigations.
   • Restrict affected Windows Zoom clients to trusted network segments; avoid untrusted/public Wi-Fi where interception is feasible.
   • Enforce TLS inspection at the egress proxy so that forged self-signed or untrusted-CA certificates presented to clients are detected and blocked; alert on any client that proceeds past a TLS validation event.
   • Disable automatic redirection and untrusted certificate acceptance at the OS level where policy permits; monitor certificate chain events from Zoom executables.
   • Monitor the vendor advisory channel (Zoom Security Bulletins) for the pending fix and for clarified affected versions.
2. Patch / upgrade steps.
   • No patch currently exists. Track https://nvd.nist.gov/vuln/detail/CVE-2026-108184 and the Zoom security bulletin page. When a fixed client version is published, upgrade all affected Windows clients and verify client version compliance through your endpoint management tooling.
3. Long-term hardening.
   • Deploy and enforce certificate pinning or strict validation policy through managed application configuration where the vendor supports it.
   • Integrate detection rules above into SOC monitoring; treat repeated Zoom-client connections to non-vendor endpoints as potential interception.
   • Maintain certificate transparency and revocation monitoring on endpoints to surface clients accepting invalid chains.
   • Add affected software inventory tracking to ensure swift remediation the moment a version range and patch are published.

References

• NVD — CVE-2026-108184: https://nvd.nist.gov/vuln/detail/CVE-2026-108184
• MITRE CWE-295 — Improper Certificate Validation: https://cwe.mitre.org/data/definitions/295.html
• FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-108184 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Zoom Security Bulletins / Trust Center (monitor for advisory and fixed client version): https://www.zoom.com/en/trust/security-bulletin/

No threat actor campaigns or exploit-in-the-wild evidence are known for CVE-2026-108184 at the time of writing.