High-Severity Vulnerabilities Patched by Ivanti and Zoom: Affected Products, CVEs, and What to Update

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

High-severity vulnerabilities patched by Ivanti and Zoom affect separate enterprise access, collaboration, endpoint, mobile, VDI, and meeting-room products. As of August 16, 2026, Zoom lists one critical and several high-severity 2026 fixes, while Ivanti has disclosed a July 2026 Xtraction update and documented high-severity 2025 gateway flaws.

These are separate vendor disclosures, not one coordinated incident. Zoom’s most recent listed fixes were published July 14, 2026, while Ivanti’s July 2026 Patch Tuesday update covered Ivanti Xtraction. Ivanti’s best-documented gateway vulnerabilities in the supplied advisories were disclosed in August 2025.

#	Preview	Product	Price
1		Bitdefender Total Security 2026 – Complete Antivirus and Internet Security Suite – 5 Devices | 1...	$19.99	Buy on Amazon
2		Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]	$19.99	Buy on Amazon
3		McAfee Total Protection 2027 Antivirus Software for 3 Devices | Auto-Renews	$23.99	Buy on Amazon
4		McAfee Total Protection 2027 Antivirus Software for 5 Devices | Auto-Renews	$29.99	Buy on Amazon
5		Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]	$24.99	Buy on Amazon

Key takeaways

• Zoom lists critical CVE-2026-53412 in Zoom Workplace for Windows and high-severity fixes affecting Windows clients, Zoom Rooms, VDI plugins, mobile clients, Contact Center Remote Control, and other products during 2026.
• Zoom’s latest listed 2026 high-severity and critical bulletins were published July 14, 2026; Zoom’s bulletin index was updated July 15 for the critical Windows issue.
• Ivanti’s July 2026 Patch Tuesday update fixed two Ivanti Xtraction CVEs—one High and one Medium—but the supplied search result does not expose their identifiers or fixed builds.
• Ivanti CVE-2025-5456 and CVE-2025-5462 were rated CVSS 7.5 High and described as remote unauthenticated denial-of-service vulnerabilities, not confirmed remote-code-execution flaws.
• Internet-facing Ivanti gateways, privileged Windows Zoom systems, Zoom Rooms, and VDI deployments deserve priority because operational impact and privilege context can matter more than a severity label alone.

What did Ivanti and Zoom patch?

Ivanti and Zoom patched different products on different disclosure timelines. Zoom’s 2026 bulletins cover collaboration software and related clients, while Ivanti’s current July 2026 update covers Xtraction and its more fully documented gateway flaws come from an August 2025 security update.

The most important immediate distinction is evidence quality: Zoom’s bulletin index provides a product-by-product list of 2026 CVEs, but the available Ivanti July 2026 summary confirms only the Xtraction product and severity split. Administrators should obtain the full Ivanti advisory or authenticated support documentation before relying on a CVE number or fixed-build claim for Xtraction.

#1 Best Overall

Bitdefender Total Security 2026 – Complete Antivirus and Internet Security Suite – 5 Devices | 1 Year Subscription | PC/Mac | Activation Code by Mail

• SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
• SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
• ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
• ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.

$19.99

Buy on Amazon

At-a-glance vulnerability table

Zoom’s security bulletin index is the source for the 2026 Zoom bulletin numbers, products, CVEs, severities, and publication dates. Zoom cautions that its bulletin page does not provide individual-customer impact guidance or every additional vulnerability detail; Zoom recommends updating software to the latest applicable version.

Which Zoom vulnerabilities are most urgent?

CVE-2026-53412 should be the first Zoom remediation item because Zoom classifies the Zoom Workplace for Windows flaw as Critical. The available bulletin listing does not establish the fixed version, exploitation status, attack outcome, or whether exploitation requires authentication, so administrators should not infer those details from the title “improper input validation.”

The July 14 Windows fixes deserve immediate attention after the critical issue. CVE-2026-53409 affects Zoom Rooms for Windows through improper privilege management, CVE-2026-53410 affects Zoom Clients for Windows through a race condition, and CVE-2026-53411 affects the Zoom Workplace VDI Plugin for Windows through improper input validation. Shared meeting-room systems, centrally managed VDI environments, and Windows systems running with elevated privileges warrant particular scrutiny.

Mobile users also need a separate check. According to NVD’s record for CVE-2026-53408, the vendor-supplied data identifies Zoom Workplace versions before 7.0.4 on Android and before 7.0.3 on iOS as affected. NVD describes a network-accessible escalation-of-privilege condition and assigns CVSS 8.1 High. “Before version” means versions lower than the stated platform-specific threshold; Android and iOS should not be treated as having the same fixed-version requirement.

Rank #2

Sale

Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]

• ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
• TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
• ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
• REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
• DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.

$19.99

Buy on Amazon

The June Contact Center Remote Control issue, May Zoom Rooms and VDI issues, and March Windows client issue should be included in an enterprise inventory review even if an organization has already addressed the July fixes. A download being initiated does not prove that the updated binaries were installed and loaded.

What are the documented Ivanti vulnerabilities?

Ivanti’s July 2026 Patch Tuesday update says Ivanti Xtraction received a security update resolving two CVEs, one rated High and one rated Medium. The supplied Ivanti July 2026 update does not expose the CVE identifiers, affected versions, or fixed build numbers in the available search result. Those details should be confirmed through Ivanti’s complete July Security Advisory or authenticated support portal before publication of a precise Xtraction version instruction.

The better-documented Ivanti issues are CVE-2025-5456 and CVE-2025-5462, which affect Ivanti Connect Secure, Ivanti Policy Secure, Ivanti ZTA Gateway, and Ivanti Neurons for Secure Access. Both were rated CVSS 7.5 High by Ivanti.

NVD describes CVE-2025-5456 as a buffer over-read that can create a remote unauthenticated denial-of-service condition. NVD describes CVE-2025-5462 as a heap-based buffer overflow that can create a remote unauthenticated denial-of-service condition. The available descriptions do not establish remote code execution, confirmed data theft, or confidentiality loss, so those outcomes should not be attributed to these CVEs.

Rank #3

Sale

McAfee Total Protection 2027 Antivirus Software for 3 Devices | Auto-Renews

• THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
• PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
• SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
• GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
• MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.

$23.99

Buy on Amazon

Ivanti fixed releases for the documented gateway flaws

Ivanti’s August 2025 security update is the relevant vendor source for the disclosure and fixed-release context. Product release trains differ, so “update Ivanti” is not sufficient as an enterprise change instruction.

Were the Ivanti or Zoom vulnerabilities exploited?

There is no supplied authoritative evidence establishing exploitation of the 2026 Zoom vulnerabilities. The available Zoom search results do not say that CVE-2026-53412 or any of the listed high-severity Zoom CVEs were exploited in the wild. Administrators should check the individual Zoom bulletins, CISA’s Known Exploited Vulnerabilities catalog, and credible incident-response reporting for later updates.

Ivanti said it had no evidence of exploitation in the wild for the vulnerabilities disclosed in its August 2025 update at the time of disclosure. That is a time-bound vendor statement, not proof that the vulnerabilities were never exploited or that a particular appliance is clean.

Ivanti separately acknowledged that CVE-2025-0282 had affected a limited number of Connect Secure appliances at disclosure, while saying it was not aware of exploitation in Policy Secure or Neurons for ZTA gateways. That earlier incident context should not be conflated with the July 2026 Xtraction update or with CVE-2025-5456 and CVE-2025-5462. Ivanti’s Connect Secure, Policy Secure, and Neurons for ZTA update provides that separate context.

Rank #4

Sale

McAfee Total Protection 2027 Antivirus Software for 5 Devices | Auto-Renews

• THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
• PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
• SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
• GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
• MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.

$29.99

Buy on Amazon

Who should patch first?

Patch priority should combine severity, exposure, privilege, business impact, and evidence of compromise. A High CVSS score does not automatically mean active exploitation, and a denial-of-service flaw can still be operationally severe when it affects remote-access infrastructure.

What should administrators do now?

Ivanti remediation checklist

1. Inventory every Ivanti deployment. Record whether the organization operates Connect Secure, Policy Secure, ZTA Gateway, Neurons for Secure Access, or Xtraction, along with the exact installed release and exposure to the internet.
2. Map the exact release to the correct advisory. For CVE-2025-5456 and CVE-2025-5462, compare the installed product release with the product-specific fixed releases in the table above. For Xtraction, obtain Ivanti’s full July 2026 advisory before recording a CVE or fixed-build value.
3. Plan gateway maintenance safely. Ivanti gateway upgrades can interrupt remote access. Arrange a maintenance window, confirm out-of-band administration, preserve relevant logs and configuration evidence, and prepare a tested recovery plan.
4. Check integrity when the product is internet-facing or compromise is plausible. Ivanti’s remediation guidance directs customers to use the External Integrity Checker where recommended, apply the patch, restore services as appropriate, and continue monitoring. The Ivanti remediation FAQ contains the vendor’s product-specific guidance.
5. Do not treat patching as proof of cleanliness. Review authentication, VPN, administrator, configuration-change, and anomalous outbound-traffic logs. Follow any required factory-reset, credential-rotation, or other vendor-prescribed procedure if compromise indicators exist.
6. Verify the resulting build. Confirm that the appliance reports the expected patched release, then continue monitoring for unusual authentication failures, administrative activity, and availability problems.

Zoom remediation checklist

1. Inventory Zoom by product, platform, and deployment type. Include Zoom Workplace clients, Zoom Rooms, VDI plugins, Contact Center Remote Control, Android clients, and iOS clients. “Zoom” is not one affected product or one version line.
2. Prioritize the critical Windows client issue. Address CVE-2026-53412 first among the listed Zoom issues, then address the July high-severity Windows, Rooms, and VDI fixes.
3. Use normal endpoint-management controls. Push updates through the organization’s approved software-distribution process and account for offline devices, restrictive application-control policies, and systems that do not regularly check in.
4. Verify installation, not just delivery. Check the installed Zoom version after deployment. Relaunching Zoom or rebooting the endpoint may be required before updated binaries are active.
5. Test VDI compatibility. Update VDI plugins in a controlled sequence and verify compatibility between the plugin and the associated virtual-desktop or host components before expanding deployment.
6. Schedule Zoom Rooms carefully. Shared room endpoints may require a maintenance window so that meetings are not disrupted and the updated client is actually relaunched.
7. Check mobile platforms separately. Confirm Android devices meet version 7.0.4 or later and iOS devices meet version 7.0.3 or later for the CVE-2026-53408 thresholds reported by NVD’s vendor-supplied data.
8. Use compensating controls if a device cannot be patched immediately. Least privilege, application allowlisting, endpoint detection, controlled custom-URL handling, and network restrictions can reduce exposure, but these measures do not replace the vendor update.

What can go wrong during remediation?

• Using “latest version” without a build check: Enterprise products often have multiple release trains. Record the exact installed and target builds rather than relying on a generic update instruction.
• Updating only the main Zoom client: Zoom Rooms, VDI plugins, Contact Center remote-control components, Android, and iOS have separate product and version scopes.
• Updating a VDI plugin unevenly: Client-host incompatibility can disrupt virtual desktop access, so test the deployment sequence before changing the entire fleet.
• Updating a room endpoint during a meeting: Zoom Rooms are shared operational systems and should be patched during an approved maintenance period.
• Patching an Ivanti appliance without investigation: A successful upgrade does not establish that earlier persistence or stolen credentials are absent. Preserve evidence and follow Ivanti’s integrity and remediation guidance where appropriate.
• Assuming severity equals exploitation: High severity is a prioritization input, not evidence of active exploitation. Conversely, a lack of known exploitation does not justify leaving an exposed gateway or critical endpoint unpatched.
• Assuming an advisory applies to every product: The Ivanti July 2026 Xtraction update is not a Connect Secure patch, and not every Zoom product is affected by every Zoom bulletin.

What is not yet known?

Several details require a fresh check immediately before publication or deployment. The supplied evidence does not expose the fixed Zoom builds for the listed 2026 bulletins, the exploitation status of the 2026 Zoom CVEs, or the CVE identifiers and fixed versions for Ivanti Xtraction’s July 2026 update.

Those gaps should be resolved from the individual vendor bulletins or authenticated support documentation. An organization also cannot determine whether a vulnerability exists in its own environment from the CVE list alone; asset inventory and installed-version verification are required.

How should organizations keep this article current?

Use the Zoom security bulletin index for later bulletin updates and product-specific release information. Use Ivanti’s July 2026 Patch Tuesday advisory and authenticated support documentation to fill the Xtraction evidence gap. Recheck exploitation assessments against authoritative incident-response reporting and the CISA Known Exploited Vulnerabilities catalog before changing the article’s exploitation language.

Best Value

Sale

Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]

• ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
• TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
• ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
• REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
• DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.

$24.99

Buy on Amazon

Frequently Asked Questions

Are Ivanti and Zoom vulnerabilities part of the same security incident?

No. Ivanti and Zoom disclosed separate vulnerabilities affecting different products and timelines. The article covers both because each vendor patched serious flaws, not because the vendors reported one shared campaign or coordinated incident.

Are CVE-2025-5456 and CVE-2025-5462 remote-code-execution vulnerabilities?

The supplied NVD descriptions identify CVE-2025-5456 and CVE-2025-5462 as remote unauthenticated denial-of-service vulnerabilities in affected Ivanti products. The available evidence does not support calling either CVE a confirmed remote-code-execution flaw.

Which Zoom mobile versions address CVE-2026-53408?

According to vendor-supplied data in NVD, Zoom Workplace versions before 7.0.4 on Android and before 7.0.3 on iOS are affected by CVE-2026-53408. Administrators should verify the current vendor bulletin because mobile requirements can change.

Does patching an Ivanti gateway prove that it was not compromised?

No. Patching an Ivanti gateway does not prove that earlier exploitation, persistence, or credential theft did not occur. Internet-facing appliances should be assessed with the vendor-recommended integrity checks, log review, credential assessment, and any required remediation procedure.

The Bottom Line

Patch CVE-2026-53412 and the other applicable Zoom Windows, Rooms, VDI, mobile, and Contact Center components according to the current Zoom bulletins. Patch exposed Ivanti gateways against the exact product-specific release, and investigate their integrity rather than assuming an update alone proves they are clean. Treat Ivanti’s July 2026 Xtraction details as incomplete until the full vendor advisory confirms the CVEs and fixed builds.

Quick Recap

Bestseller No. 1

Bitdefender Total Security 2026 – Complete Antivirus and Internet Security Suite – 5 Devices | 1 Year Subscription | PC/Mac | Activation Code by Mail

$19.99

SaleBestseller No. 2

Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]

$19.99

SaleBestseller No. 3

McAfee Total Protection 2027 Antivirus Software for 3 Devices | Auto-Renews

$23.99

SaleBestseller No. 4

McAfee Total Protection 2027 Antivirus Software for 5 Devices | Auto-Renews

$29.99

SaleBestseller No. 5

Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]

$24.99

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.