Two major software vendors, Zoom and Xerox, have released critical security updates that address vulnerabilities potentially exploitable by attackers to gain elevated privileges or execute malicious code.
🔐 Zoom Clients for Windows (CVE-2025-49457 – CVSS 9.6)
- Root cause: Untrusted search path vulnerability.
- Impact: Could allow an unauthenticated attacker to escalate privileges remotely.
- Affected Products:
- Zoom Workplace for Windows < 6.3.10
- Zoom Workplace VDI for Windows < 6.3.10 (except 6.1.16 & 6.2.12)
- Zoom Rooms & Controllers for Windows < 6.3.10
- Zoom Meeting SDK for Windows < 6.3.10
- Fix: Upgrade to version 6.3.10 or later.
🖨️ Xerox FreeFlow Core (Multiple CVEs)
- CVE-2025-8355 (CVSS 7.5): XML External Entity (XXE) flaw → Server-Side Request Forgery (SSRF).
- CVE-2025-8356 (CVSS 9.8): Path Traversal vulnerability → Remote Code Execution (RCE).
- Exploit Potential: Attackers could upload malicious files, drop web shells, execute arbitrary commands, and steal sensitive information.
- Fix: Update to version 8.0.4 immediately.
💡 Why it matters:
Both vulnerabilities are highly exploitable and pose serious risks for enterprises. Attackers could leverage them not only to compromise affected systems but also to move deeper into corporate environments.
✅ Recommended Action:
- Ensure Zoom Clients are updated to 6.3.10+.
- Patch Xerox FreeFlow Core to 8.0.4.
- Audit systems for suspicious activity if updates were delayed.
📌 At Alcaeus Services, we help organizations stay ahead of vulnerabilities with proactive monitoring and patch management strategies.
