CVE-2022-22785

mediumpriority · track · 37EPSS 0.035 · 89 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

3.52% (89th) EPSS

CVSS 6.4 · medium

Is it mine?

7 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-27

The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated attack to send an unsuspecting users Zoom-scoped session cookies to a non-Zoom domain. This could potentially allow for spoofing of a Zoom user.

cvss

Technical severity, 0–10. One row per scoring source.

9.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 5.9–9.1

v2.06.4mediumAV:N/AC:L/Au:N/C:P/I:P/A:Nprimary · NVD / NIST USexploitability 10 · impact 4.9

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 5.2

v3.15.9mediumAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:Lsecondary · FSTEC (BDU) RU

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:Lsecondary · ENISA EU

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:Lsecondary · security@zoom.usexploitability 1.6 · impact 4.2

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-565USprimaryCWE-200USCWE-539US

affected products (7)

Products and version ranges known to be affected.

Zoom Video Communications Inc Zoom Client for Meetings for Androidunspecified → 5.10.0enisa_euvdEU
Zoom Video Communications Inc Zoom Client for Meetings for Linuxunspecified → 5.10.0enisa_euvdEU
Zoom Video Communications Inc Zoom Client for Meetings for Windowsunspecified → 5.10.0enisa_euvdEU
Zoom Video Communications Inc Zoom Client for Meetings for iOSunspecified → 5.10.0enisa_euvdEU
Zoom Video Communications Inc Zoom Client for Meetings for macOSunspecified → 5.10.0enisa_euvdEU
Zoom Video Communications, Inc. Zoom Client for Meetings≤ 5.10.0fstec_bduRU
zoom meetings< 5.10.0nvdUScpe:2.3:a:zoom:meetings:*:*:*:*:*:*:*:*

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

published 2022-05-18modified 2026-06-17

related (88)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-0257US	critical9.1OT critical	95.0% (100th)	KEV	2026-05-13
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establi…
CVE-2023-35885US	critical9.8	73.5% (99th)	Exploit	2023-06-20
CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.
CVE-2008-5784US	critical9.8	7.10% (94th)	Exploit	2008-12-31
V3 Chat - Profiles/Dating Script 3.0.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1.
CVE-2026-39324US	critical9.8OT high	0.27% (19th)	Exploit	2026-04-07
Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secret…
CVE-2017-6896US	high8.8	3.70% (90th)	Exploit	2017-03-14
Privilege escalation vulnerability on the DIGISOL DG-HR1400 1.00.02 wireless router enables an attacker to escalate from user privilege to admin privilege just by modifying the Bas…

+83 more

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan