Nigeria’s National Information Technology Development Agency (NITDA) has warned Zoom users about a critical security vulnerability that could allow attackers to take control of accounts without valid login credentials.
The warning was issued on Monday by the NITDA Computer Emergency Readiness and Response Team (NITDA-CERRT), which identified the vulnerability as CVE-2026-53412.
The agency urged users and organisations running affected Zoom applications to install the latest security updates immediately and strengthen account protection with measures such as multi-factor authentication (MFA).
According to NITDA-CERRT, the security flaw is linked to improper input validation and can be exploited remotely over a network without authentication.
This means an attacker may not need a user’s password or other valid credentials to exploit the vulnerability.
The agency warned that a successful attack could result in unauthorised access to Zoom accounts, potentially exposing confidential meetings, chat conversations, recordings and shared files.
It could also allow attackers to impersonate legitimate users, increasing the risk of phishing, fraud and social engineering attacks.
The vulnerability affects Zoom Workplace for Windows and Zoom Workplace VDI Client for Windows.
NITDA-CERRT advised users of Zoom Workplace for Windows to upgrade to version 7.0.0 or later.
Users of Zoom Workplace VDI Client for Windows were advised to upgrade to version 7.0.10, 6.6.15, 6.5.18 or later, depending on their supported release branch.
The agency also urged organisations to verify that their Zoom desktop applications are running supported versions and to strengthen patch management systems to ensure security updates are deployed promptly.
Beyond updating the software, NITDA-CERRT recommended that users enable multi-factor authentication on their Zoom accounts.
Organisations were also advised to limit administrative privileges in line with the principle of least privilege, ensuring that users have only the level of access required to perform their duties.
The agency further advised users and organisations to monitor account activity and authentication logs for unusual login attempts or other signs of unauthorised access.
Employees should also be trained to identify and report suspicious activity involving their accounts.
The latest warning highlights the increasing cybersecurity risks facing organisations as businesses, government agencies and individuals rely more heavily on digital collaboration platforms.
Video-conferencing applications such as Zoom are often used to discuss sensitive corporate, financial and government information. A compromised account could therefore provide attackers with access to information beyond the affected user’s individual profile.
For businesses, the potential consequences could include data breaches, financial losses, reputational damage and disruption to operations.
NITDA’s warning therefore reinforces the need for organisations to treat software updates and cybersecurity controls as part of routine business operations rather than as occasional emergency measures.
The Zoom warning is the latest in a series of cybersecurity advisories issued by NITDA-CERRT.
Earlier this month, the agency warned WordPress users about CVE-2026-64638, a vulnerability that could allow attackers to execute malicious PHP code on affected websites without authentication.
NITDA advised affected website administrators to update WordPress Core and strengthen protections through measures including web application firewalls, security plugins, access controls and regular backups.
The agency has also continued to develop Nigeria’s broader digital infrastructure and cybersecurity framework as the country expands its adoption of cloud computing, artificial intelligence and other digital technologies.
For Zoom users, however, the immediate message is straightforward: update affected applications, enable MFA and closely monitor accounts for suspicious activity.
