This vulnerability, identified as CWE-79, affects Zoom Workplace Apps by failing to properly sanitize input during web page generation, enabling cross-site scripting attacks. An unauthenticated attacker with access to the adjacent network could exploit this flaw to alter data integrity. The CVSS 3.1 base score is 4.6 (medium), reflecting low complexity and no required privileges but requiring user interaction. No vendor-provided patch or official remediation level is currently available, and the product is not a cloud service, so remediation depends on Zoom's updates to the affected apps.

The impact is limited to a loss of integrity, meaning an attacker could potentially manipulate data or content displayed by the application. There is no direct impact on confidentiality or availability. Exploitation requires adjacent network access and user interaction, which limits the attack surface. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation level has been published by Zoom, users should monitor Zoom's security advisories for updates. Until a patch is available, limiting adjacent network access and exercising caution with untrusted content in Zoom Workplace Apps may reduce risk.