CVE-2026-53418
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-53418 is a high-severity Improper Authorization in Handler for Custom URL Scheme (CWE-939) vulnerability in Zoom Workplace (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Security Account Manager (T1003.002); ranked at the 13th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-98747
Vulnerability Data
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement directly stops unauthorized actors from invoking the custom URL handler by requiring approved authorizations for that entry point.
Least privilege limits the authorizations granted to the handler, reducing the chance that any actor can invoke it without restriction.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Defining, enforcing, and reviewing access permissions directly addresses the missing authorization checks for custom URL scheme handlers.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.15 only requires defining a topic-specific access control policy and determining requirements; it does not itself enforce authorization decisions or stop the custom URL scheme handler from being invoked by unauthorized actors.
A.5.18 governs the provisioning, review, and revocation of access rights for authenticated identities; it does not remove the specific code-level flaw in a custom URL scheme handler that fails to restrict invoking actors.
A.8.2 controls allocation/review/expiry of privileged rights via authorization and policy; it does not remove the specific authorization flaw inside a custom-URL-scheme handler (a first-party code defect).
Requires security requirements that define which callers are permitted to trigger custom URL handlers, mitigating the authorization gap.
Mandates secure coding practices that include proper authorization checks before executing actions triggered by custom URL schemes.