[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fH7IhgnNJ5Z4NSByQNxN2RXsknQbnO8XUiJmqchhnnms":3},{"article":4,"iocs":50,"watch_terms":64,"solutions":65,"lesson":101},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"82ab3dad-c310-402d-92a3-9eee1a13e1ab","Splunk, Zoom Patch Critical Vulnerabilities","splunk-zoom-patch-critical-vulnerabilities-a8a686","The flaws could allow attackers to access credentials and data, take over accounts, and escalate their privileges. The post Splunk, Zoom Patch Critical Vulnerabilities appeared first on SecurityWeek.","Splunk and Zoom announced patches for multiple critical and high-severity vulnerabilities across their products. Splunk addressed three product-specific flaws (CVE-2026-20296, CVE-2026-20297, CVE-2026-20298) plus dozens of third-party library vulnerabilities in patched Enterprise versions. Zoom's most severe issue is CVE-2026-53412 (CVSS 9.8), a critical remote account takeover flaw in Workplace and Workplace VDI Client for Windows, along with three high-severity privilege elevation and race condition bugs.","Splunk and Zoom release patches for critical vulnerabilities affecting credentials, account access, and privilege","https:\u002F\u002Fwww.securityweek.com\u002Fsplunk-zoom-patch-critical-vulnerabilities\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F06\u002FZoom-Data-Security-Privacy.jpg","2026-07-16T10:54:34+00:00","2026-07-16T12:00:19.220784+00:00",8,[17,20,22,25,27,30],{"name":18,"type":19},"Splunk","vendor",{"name":21,"type":19},"Zoom",{"name":23,"type":24},"Splunk Enterprise","product",{"name":26,"type":24},"Zoom Workplace",{"name":28,"type":29},"OpenSSL","technology",{"name":31,"type":29},"Golang","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},[51,55,58,61],{"type":52,"value":53,"context":54},"cve","CVE-2026-20296","Splunk high-severity command safeguards bypass",{"type":52,"value":56,"context":57},"CVE-2026-20297","Splunk high-severity path traversal vulnerability",{"type":52,"value":59,"context":60},"CVE-2026-20298","Splunk medium-severity information disclosure",{"type":52,"value":62,"context":63},"CVE-2026-53412","Zoom critical remote account takeover in Workplace\u002FWorkplace VDI Client (CVSS 9.8)",[18,21,23],{"controls":66,"vendors":95},[67],{"slug":68,"name":69,"problem":70,"products":71},"patch-management","Automated patch management","Known holes get closed in days, not months.",[72,79,87],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":68,"product_name":76,"url":77,"description":78},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",[96],{"slug":97,"name":18,"logo_path":98,"roles":99},"splunk","\u002Fvendor-logos\u002Fsplunk.png",[100],"affected",{"slug":102,"title":103,"body":104,"framework_refs":105,"framework_notes":114},"splunk-zoom-release-critical-patches-including-cvss-98-account-takeover-flaw","Splunk & Zoom Release Critical Patches Including CVSS 9.8 Account Takeover Flaw","Both Splunk and Zoom disclosed and patched critical vulnerabilities, with Zoom's CVE-2026-53412 scoring a near-maximum CVSS 9.8, enabling remote account takeover on Windows clients — a severe risk for enterprise environments where these tools are widely deployed. Splunk's patches addressed not only product-specific flaws but also dozens of third-party library vulnerabilities, highlighting the compounding risk of unpatched dependencies within complex software ecosystems. Delayed patching of widely-used enterprise tools creates broad attack surfaces, as threat actors actively scan for and exploit known CVEs shortly after public disclosure. Organizations that fail to prioritize timely patch cycles for critical business software risk unauthorized access, privilege escalation, and potential full system compromise.",[106,107,108,109,110,111,112,113],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","NIST SA-12: Supply Chain Risk Management (third-party libraries)","ITIL Change Management: Emergency Change Procedures","GDPR Article 32: Security of Processing (timely remediation of known vulnerabilities)",{}]