Critical Zoom Vulnerability Exposes All Platforms to Remote Takeover via Screen Sharing Annotations
A high-risk vulnerability in Zoom Workplace clients has been disclosed, allowing attackers to remotely take over devices through the screen-sharing annotation feature. The flaw impacts every major platform, including Windows, Mac, iOS, Android, and Linux.
Security researcher details published by PCMag on August 13 describe an attack that activates the moment a user starts screen sharing and enables the annotation tool. No additional victim actions are required, and the compromise leaves no visible pop-ups or warnings.
Attack Mechanics and Scope
Once triggered, the attacker gains complete access to files, passwords, cameras, and microphones. The vector is especially dangerous because screen sharing and annotations are standard features in remote meetings used by hundreds of millions of users daily.
Researchers at A Security showed that generative AI reduced exploit creation time to just 24 hours using carefully crafted prompts, removing the need for elite teams or large budgets previously required for such attacks.
Immediate Mitigation Steps
- Update Zoom Workplace to the latest patched version immediately.
- Apply available macOS updates addressing related issues in Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.
- Avoid enabling the annotation tool during sensitive meetings.
- Monitor system processes for unexpected background activity.
The disclosure underscores a broader trend: AI is rapidly democratizing sophisticated attack development, increasing pressure on organizations and individuals to maintain rigorous patch hygiene.
Related articles
New Windows 11 Bypass Lets Users Skip Internet and Microsoft Account During Setup
A new method has been discovered that allows Windows 11 Home users to complete initial setup without an internet connection or Microsoft account. The technique requires no command-line tools or scripts and was found by enthusiast Bob Pony. During the OOBE process, users simply open the sign-in options and click the Learn more link, which redirects the wizard to local account creation. Previous bypasses such as OOBE\bypassnro and start ms-cxh:localonly have already been blocked by Microsoft. The new approach appears to be an overlooked interface element and works only on the Home edition. Microsoft is expected to close this loophole in a future update as it continues tightening account requirements.
CISA Adds Four Actively Exploited Vulnerabilities in GitLab, ConnectWise ScreenConnect and JFrog Artifactory to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency has added four vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The flaws affect GitLab Community Edition and Enterprise Edition, ConnectWise ScreenConnect, and JFrog Artifactory. CVE-2026-85706 allows unauthenticated path traversal in GitLab’s commit API, enabling arbitrary file reads. CVE-2026-84869 in ScreenConnect permits unauthorized file transfer and execution over active remote sessions. Two additional issues in Artifactory, CVE-2026-42018 and CVE-2026-42016, can lead to token leakage and privilege escalation. Federal agencies have been directed to apply mitigations and investigate potential compromises by specific deadlines.
Critical Vulnerability in ConnectWise ScreenConnect Enables Unauthorized File Transfers
ConnectWise has disclosed a serious vulnerability in its remote access product ScreenConnect that allows attackers to transfer and execute files from active remote sessions without requiring authorization or host-side confirmation. The flaw, tracked as CVE-2026-84869, impacts both Support and Access session types and carries a CVSS v3.1 base score of 9.9, placing it in the Critical severity category. The company rated the issue as Important in its three-tier scale and assigned it the highest priority of High. Exploitation of the vulnerability has already been confirmed in the wild, increasing the urgency for organizations using the product. ConnectWise published the security advisory on September 8, 2026, urging users to apply available mitigations promptly. The vulnerability stems from improper handling in the file transfer process within the client component.
Can IDOR Vulnerabilities Be Found Through Static Analysis? New Python Kernel Aims to Answer the Question
A researcher has developed a static analysis module for detecting Insecure Direct Object Reference (IDOR) vulnerabilities in Python web applications. The tool moves beyond simple heuristics by tracking the relationship between user-controlled identifiers, database objects, and authorization checks. It supports Django, Django REST Framework, Flask, and FastAPI, using a custom taint-tracking system called SIAOD to label data origins. Existing approaches such as OpenAPI specifications, broad AST heuristics, Semgrep, and CodeQL were analyzed and found insufficient for capturing the precise semantics of IDOR. Testing on 150 small repositories yielded 48 true positives out of 112 findings, while analysis of 12 million lines of production code from 15 companies produced only five confirmed issues amid hundreds of false positives caused by authorization logic residing outside handler functions. The work demonstrates both the feasibility and current limitations of deterministic static detection for this vulnerability class.