Nigeria’s National Information Technology Development Agency (NITDA) has warned Zoom users about a critical vulnerability that could allow attackers to remotely take over accounts without valid credentials. The warning was issued on Monday by the NITDA Computer Emergency Readiness and Response Team (NITDA-CERRT) over the vulnerability tracked as CVE-2026-53412. NITDA-CERRT advised users to update affected Zoom applications immediately and implement additional security measures, including multi-factor authentication (MFA). What NITDA is saying
NITDA-CERRT said the vulnerability is caused by improper input validation and can be exploited remotely over a network without requiring authentication. “The vulnerability is caused by improper input validation and could allow an unauthenticated attacker to remotely compromise Zoom user accounts over a network without requiring valid credentials,” NITDA-CERRT said. The agency warned that a successful attack could give unauthorised users access to confidential meetings, chat conversations, recordings and shared files.
“If exploited, attackers could take over Zoom user accounts without authorization, access confidential meetings, chat conversations, recordings and shared files,” the advisory said. The agency said the vulnerability affects Zoom Workplace for Windows and Zoom Workplace VDI Client for Windows
NITDA-CERRT warned that a successful compromise could expose sensitive organisational, government or personal information and allow attackers to impersonate legitimate users for phishing, fraud or social engineering attacks. What users should do
NITDA-CERRT advised users of Zoom Workplace for Windows to upgrade to version 7.0.0 or later. Users of Zoom Workplace VDI Client for Windows should upgrade to version 7.0.10, 6.6.15, 6.5.18 or later, depending on their supported release branch. The agency also advised organisations to verify that all Zoom desktop clients are running supported versions and to maintain a robust patch management process for timely deployment of security updates. NITDA-CERRT recommended enabling MFA across Zoom accounts and restricting administrative privileges in line with the principle of least privilege.
Users were also advised to monitor account activity and authentication logs for suspicious login attempts or unauthorised activity, while organisations should educate users to recognise and report suspicious account activity. NITDA-CERRT also advised organisations to maintain a robust patch management process to ensure Zoom security updates are deployed promptly. Get up to speed
NITDA had previously issued a warning about a WordPress vulnerability that could allow attackers to execute malicious PHP code on affected websites. The NITDA-CERRT advisory covered CVE-2026-64638, a pre-authentication flaw affecting the WordPress login screen that could be exploited without valid credentials. The agency advised administrators to update WordPress Core to version 7.0.3 and implement additional security measures, including a Web Application Firewall, security plugins, access controls and regular backups.
NITDA warned that successful exploitation could result in data theft, privilege escalation, malware injection, backdoors and full system compromise. What you should know
Earlier this month, Nairametrics reported that NITDA has also been working to strengthen the regulatory and infrastructure framework supporting Nigeria’s cloud computing ecosystem.
More Read
The agency recently signed three regulatory instruments under the National Sovereign Cloud Initiative (NSCI): the National Cloud Computing Guideline, the National Cloud Technical Guideline and the National Digital Infrastructure Assurance Framework (NDIAF), alongside the presentation of the National Cloud Investment Strategy. According to NITDA, the frameworks are designed to provide a structured national approach to cloud adoption, digital sovereignty, infrastructure assurance and investment. The agency said they will also support Nigeria’s development as a regional hub for cloud services, data centres, artificial intelligence infrastructure, sovereign computing and other critical digital infrastructure.
