A critical Zoom vulnerability was disclosed by security researchers allowing attackers to take remote control of a participant’s device via the screen-sharing annotation tool across Zoom Workplace on Windows, macOS, iOS, Android, and Linux.

Zoom urges users to update to the latest version to receive fixes and ongoing protections.

Exploitation required no action from the victim and produced no visible warning, with no confirmed real-world exploits reported at the time.

Uncertainties remain as IOcs and payload specifics have not been publicly disclosed; researchers expect updates from Microsoft, CISA KEV, and others.

Guidance includes monitoring for IOCs such as specific IPs and C2 domains, and decommissioning unsupported SharePoint servers that cannot be secured.

Related cybersecurity links and advisories are provided to inform industry coverage.

Defense notes include watching for UDP/500/4500 traffic from unknown sources, IKEEXT crashes, and SYSTEM process activity; develop correlations between IKEv2 anomalies and post-exploitation activity.

CISA’s KEV catalog has not yet listed CVE-2026-58231; broader SAP vulnerabilities are noted, with limited past impact on Commerce Cloud and no KEV entry for this CVE as of the period.

MITRE ATT&CK mapping aligns with Exploit Public-Facing Application; potential follow-ons like command execution and web shells are discussed but not confirmed publicly.

Emphasis on applying July 2026 patches promptly and monitoring for exploit activity to mitigate ongoing threats.

Experts advise private organizations to review the KEV catalog and address vulnerabilities in their infrastructure.

CISA warns administrators to harden SharePoint deployments amid active exploitation; follow Microsoft’s hardening guidance to avoid internet exposure and use authentication-enabled security controls behind Layer 7 proxies.