Insufficient Verification of Data Authenticity in Remote Control for Zoom Contact Center for Windows before…

CVE-2026-53406 is a CWE-345 (Insufficient Verification of Data Authenticity) flaw in the Remote Control component shipped with Zoom Contact Center for Windows, versions prior to 7.0.0. The component accepts control messages without properly validating their origin, so a process running as a low-privilege local user on the same Windows host can craft messages that the helper trusts and acts on. Net effect: local privilege escalation on a machine where the attacker already has an authenticated user session.

Vendor's HIGH (7.8) rating leans on the CIA-triple impact (C:H/I:H/A:H) of a successful EoP. That math is technically correct but ignores who actually runs the Remote Control for Zoom Contact Center binary — it's a niche add-on for contact-center agents, not the general Zoom Workplace install base. Combined with AV:L (no remote attack surface) and PR:L (you must already be a logged-in user), the realistic reading is MEDIUM. There's no KEV listing, EPSS is 0.08%, and no public PoC has surfaced.

Why this verdict

• Authentication required (PR:L): the attacker is already past initial access — this is a post-compromise amplifier, not an entry point.
• No network reachability (AV:L): zero exposure to the internet or LAN; no remote-trigger primitive exists.
• Narrow install base: Remote Control for Zoom Contact Center ships only with the Contact Center add-on, not core Zoom Workplace — most Zoom-using enterprises are not affected at all.
• Role multiplier — low-value role (contact-center agent workstation): chain succeeds, but blast radius is single-host EoP. No DC, no hypervisor, no CI/CD, no identity-plane role plausibly runs this component.
• Role multiplier — typical role (shared agent kiosk / VDI): chain still succeeds and yields SYSTEM-on-the-kiosk; still bounded to one host. Lateral movement requires a separate credential-theft step.
• No high-value role exists for this component — it is not canonically deployed on identity, PKI, hypervisor, backup, or kernel-mode-agent hosts, so the HARD-RULE floor for HIGH does not engage.
• Threat-intel quiet: EPSS 0.08%, no PoC, no KEV, no campaign chatter — opportunistic exploitation pressure is near zero.

Why not higher?

HIGH (vendor's call) requires either a remote vector, a high-value-role multiplier, or KEV/active-exploitation pressure — none of which apply. The component is not deployed on identity-plane or kernel-mode-agent hosts, so the deployment-role floor does not push the verdict up.

Why not lower?

LOW would undersell a confirmed C:H/I:H/A:H EoP primitive that lands SYSTEM (or elevated) on a corporate endpoint. EoP-to-SYSTEM is still a meaningful step in an attacker's kill chain even if it requires a prior foothold, so MEDIUM is the honest read.

1. Inventory which Windows endpoints actually have Remote Control for Zoom Contact Center installed — Most orgs running Zoom do *not* have the Contact Center add-on — scope first. Use SCCM/Intune/Tanium to query for the helper binary path or installed-product GUID. Do this within the noisgate remediation window — there is no mitigation SLA at MEDIUM.
2. Force-upgrade affected agents to Remote Control for Zoom Contact Center ≥ 7.0.0 — Push via your existing Zoom update channel or MSI deployment. Schedule alongside your normal monthly patch ring; no need to break change windows.
3. Restrict interactive logon on contact-center workstations to the agent role only — Removes the casual-attacker population. Group Policy 'Allow log on locally' / 'Deny log on locally' scoped to the contact-center OU shrinks the prerequisite population for *every* local-auth bug, not just this one.
4. Enable EDR child-process rules for the Zoom Remote Control helper — Alert on cmd.exe / powershell.exe / rundll32.exe spawning from the helper's process tree. Catches the post-EoP execution stage even without a signature for the forged message.

Run on each Windows endpoint suspected to have Zoom Contact Center installed (i.e., contact-center agent workstations). Invoke from an admin PowerShell session: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-53406.ps1. Requires local admin to read installed-product registry hives reliably; outputs VULNERABLE / PATCHED / UNKNOWN.

# Check-CVE-2026-53406.ps1
# Detects vulnerable Remote Control for Zoom Contact Center (< 7.0.0)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN / not installed

$ErrorActionPreference = 'SilentlyContinue'
$fixedVersion = [Version]'7.0.0'
$found = $false
$vuln  = $false
$observed = $null

# 1. Look in 32/64-bit Uninstall registry hives
$uninstallPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
foreach ($p in $uninstallPaths) {
    Get-ItemProperty $p | Where-Object {
        $_.DisplayName -match 'Remote Control.*Zoom Contact Center' -or
        $_.DisplayName -match 'Zoom Contact Center.*Remote Control'
    } | ForEach-Object {
        $found = $true
        $observed = $_.DisplayVersion
        try {
            if ([Version]$_.DisplayVersion -lt $fixedVersion) { $vuln = $true }
        } catch { $vuln = $true }  # unparseable version = treat as vulnerable
    }
}

# 2. Fallback: probe common install paths for the helper binary
if (-not $found) {
    $candidatePaths = @(
        "$env:ProgramFiles\Zoom\ContactCenter\RemoteControl",
        "${env:ProgramFiles(x86)}\Zoom\ContactCenter\RemoteControl",
        "$env:LOCALAPPDATA\Zoom\ContactCenter\RemoteControl"
    )
    foreach ($path in $candidatePaths) {
        if (Test-Path $path) {
            $exe = Get-ChildItem $path -Filter '*.exe' -Recurse | Select-Object -First 1
            if ($exe) {
                $found = $true
                $observed = $exe.VersionInfo.FileVersion
                try {
                    if ([Version]$exe.VersionInfo.FileVersion -lt $fixedVersion) { $vuln = $true }
                } catch { $vuln = $true }
            }
        }
    }
}

if (-not $found) {
    Write-Output 'UNKNOWN: Remote Control for Zoom Contact Center not detected on this host'
    exit 2
}
if ($vuln) {
    Write-Output "VULNERABLE: detected version $observed (< 7.0.0)"
    exit 1
}
Write-Output "PATCHED: detected version $observed"
exit 0

Sources

1. Zoom Security Bulletins index
2. HawkEye Weekly Threat Landscape Digest — Week 24, 2026
3. CVE Details — Zoom vulnerability list
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS data
6. NVD — CVE lookup
7. MITRE CWE-345 — Insufficient Verification of Data Authenticity