Zoom Screen-Sharing Flaw Allowed Full Device Takeover; Patched Under Bulletin ZSB-26015

Cybersecurity researchers discovered a vulnerability in Zoom's screen-sharing function that could allow an attacker to take full control of another participant's device during an active call. Zoom has since deployed fixes and documented the issue in security bulletin ZSB-26015, advising all users to apply the latest updates (Engadget, Zoom Security Bulletin ZSB-26015).

The flaw resides in the annotation tool triggered when a participant shares their screen. Exploitation requires no action from the victim and produces no visible warning. When a caller launches the annotation tool during screen sharing, the attack path opens for remote execution of malicious code on the target device, giving the attacker full control without any interaction or consent prompt on the victim's side (Engadget).

The scope is broad. The vulnerability affects the Zoom Workspace app across Windows, macOS, iOS, Android, and Linux. All versions prior to the latest security updates are vulnerable, meaning any deployment that has not yet patched is potentially exposed (Engadget, Zoom Security Bulletin ZSB-26015).

What makes this discovery particularly notable is the speed of exploit development. The researchers used AI prompts to build a working exploit for the vulnerability in under 24 hours. This detail sits at the intersection of two live concerns for security teams: the attack surface of widely deployed collaboration tools, and the accelerating capability of AI-assisted vulnerability research. The annotation feature is not an obscure code path. It is a standard collaboration function enabled by default in many Zoom meeting configurations, which means the attack surface is effectively any unpatched endpoint participating in a call where screen sharing with annotation is active.

The no-interaction, no-warning nature of the exploit is the detail that should concentrate minds. Many social-engineering-adjacent vulnerabilities in collaboration software rely on some form of user interaction, a click, a file acceptance, a permission grant. This one does not. The victim's only precondition is being on a call with an attacker who initiates screen sharing and launches the annotation tool. The malicious code executes on the victim's machine with no consent dialog, no prompt, and no visible indicator that anything has occurred (Engadget).

Zoom was notified about the bug and has deployed fixes. The company's security bulletin ZSB-26015 documents the vulnerability and directs users to update to the latest version of the Zoom Workspace app. The bulletin is accessible on Zoom's trust and security portal (Zoom Security Bulletin ZSB-26015).

For IT and security teams running Zoom across distributed fleets, the immediate action is straightforward: verify that all endpoints, across every supported platform, are running the patched version. The cross-platform scope means this is not a Windows-only push. macOS, Linux, iOS, and Android clients all need attention. Mobile endpoints are often the slowest to receive updates in enterprise environments, and the inclusion of iOS and Android in the affected list means MDM-enforced update policies should be checked rather than assumed.

The AI-assisted exploit development angle is worth flagging separately. A working exploit built in under 24 hours using AI prompts is not an abstract concern about future capability. It is a present-day data point. For defenders, it compresses the window between vulnerability discovery and weaponization. The traditional assumption that there is meaningful lag between a bug being found and a reliable exploit being developed is eroding. This does not change the remediation priority for this specific Zoom vulnerability, which is already "patch immediately," but it does reshape expectations for how quickly novel vulnerabilities in widely deployed software can become active threats.

There is also a design-level question that the vulnerability surfaces. Screen-sharing and annotation are deeply integrated collaboration features, not peripheral add-ons. When a standard, default-enabled feature becomes an attack vector for full remote code execution with no user interaction, the issue is not merely a bug to patch. It is a prompt to revisit which collaborative features are enabled by default in production environments, particularly for organizations where Zoom clients run on machines with access to sensitive data or internal networks. Disabling annotation for participants who do not need it is a reasonable hardening step that reduces exposure regardless of patch status.

The remediation is available now. The risk is confined to unpatched versions. Organizations that can confirm fleet-wide updates can treat this as resolved. Those that cannot should treat any unpatched Zoom Workspace client as a potential remote access vector during any call where an untrusted participant can share their screen.

Looking at what this enables on the constructive side, the rapid discovery, responsible disclosure, and patch deployment represent the security ecosystem functioning as intended. Zoom was notified, fixes were deployed, and the bulletin is public. The AI-accelerated exploit development cuts both ways: the same tooling that compressed the attack timeline also contributed to a faster research-to-disclosure cycle. The net effect depends on which side moves first. In this case, the defenders did.