Zoom Screen-Sharing Flaw Let Attackers Take Over Devices on Active Calls — Patch Now

Cybersecurity researchers found a vulnerability in Zoom's screen-sharing feature that could let an attacker gain full control of another participant's device during a live call. Zoom has released fixes and documented the issue in security bulletin ZSB-26015, advising all users to update immediately (Engadget, Zoom Security Bulletin ZSB-26015).

The flaw lives in the annotation tool that appears when someone shares their screen during a meeting. The exploit requires no action from the victim and produces no visible warning. When a caller starts the annotation tool during screen sharing, the door opens for remote code execution on the target device. That means the attacker can run malicious code on the victim's machine with no consent dialog, no prompt, and no sign that anything happened (Engadget).

The scope is broad. The vulnerability affects the Zoom Workspace app on Windows, macOS, iOS, Android, and Linux. Any version prior to the latest security update is vulnerable, so any installation that has not yet been patched is potentially exposed (Engadget, Zoom Security Bulletin ZSB-26015).

One detail stands out: the researchers used AI prompts to build a working exploit in under 24 hours. The annotation feature they targeted is not an obscure code path. It is a standard collaboration tool enabled by default in many Zoom meeting configurations, which means the attack surface is effectively any unpatched device on a call where screen sharing with annotation is active.

The no-interaction, no-warning nature of the exploit is what should concentrate minds. Many vulnerabilities in collaboration software rely on some form of user interaction, a click, a file acceptance, a permission grant. This one does not. The victim's only precondition is being on a call with an attacker who shares their screen and launches the annotation tool. The malicious code runs on the victim's machine with no consent dialog and no visible indicator (Engadget).

Zoom was notified and has deployed fixes. Security bulletin ZSB-26015, available on Zoom's trust and security portal, documents the vulnerability and directs users to update to the latest version of the Zoom Workspace app (Zoom Security Bulletin ZSB-26015).

For IT and security teams running Zoom across distributed fleets, the immediate action is straightforward: verify that every endpoint, on every supported platform, is running the patched version. The cross-platform scope means this is not a Windows-only push. macOS, Linux, iOS, and Android clients all need attention. Mobile endpoints are often the slowest to receive updates in enterprise environments, and the inclusion of iOS and Android in the affected list means mobile device management update policies should be checked rather than assumed.

The AI-assisted exploit development angle is worth flagging separately. A working exploit built in under 24 hours using AI prompts is not an abstract concern about future capability. It is a present-day data point. For defenders, it compresses the window between vulnerability discovery and weaponization. The traditional assumption that there is meaningful lag between a bug being found and a reliable exploit being developed is eroding. This does not change the remediation priority for this specific Zoom vulnerability, which is already patch immediately, but it does reshape expectations for how quickly novel vulnerabilities in widely deployed software can become active threats.

There is also a design-level question that the vulnerability surfaces. Screen-sharing and annotation are deeply integrated collaboration features, not peripheral add-ons. When a standard, default-enabled feature becomes an attack vector for full remote code execution with no user interaction, the issue is not merely a bug to patch. It is a prompt to revisit which collaborative features are enabled by default in production environments, particularly for organizations where Zoom clients run on machines with access to sensitive data or internal networks. Disabling annotation for participants who do not need it is a reasonable hardening step that reduces exposure regardless of patch status.

The remediation is available now and the risk is confined to unpatched versions. Organizations that can confirm fleet-wide updates can treat this as resolved. Those that cannot should treat any unpatched Zoom Workspace client as a potential remote access vector during any call where an untrusted participant can share their screen.

On the constructive side, the rapid discovery, responsible disclosure, and patch deployment show the security ecosystem functioning as intended. Zoom was notified, fixes were deployed, and the bulletin is public. The AI-accelerated exploit development cuts both ways: the same tooling that compressed the attack timeline also contributed to a faster research-to-disclosure cycle. The net effect depends on which side moves first. In this case, the defenders did.