Company: ZM
Filing Date: 2025-11-25
Form Type: 10-Q
Source: 0001585521-25-000202
Chunk: 344

Company: Zoom Communications, Inc.
Filing Date: 2025-11-25
Form: 10-Q
Item: Part I, Item 8
Chunk 344
---
 to release updates to the software addressing these vulnerabilities, and we are not aware of any customers being affected or meetings compromised by these vulnerabilities. In most cases, customers are responsible for installing this update to the software, and their software is subject to these vulnerabilities until they do so. Additionally, in March 2020, a security researcher reported certain vulnerabilities related to our macOS version that could have allowed an unauthorized person to gain root access to a user’s system. Given the nature of our business and operations, our products and services will inevitably contain vulnerabilities or critical security defects that have not been identified or remediated and cannot be disclosed without compromising security. We have identified high or critical vulnerabilities in our products, services and information systems in the past, and we expect that we will continue to identify such vulnerabilities in the future. We cannot be certain that we will be able to address any vulnerabilities in our  products, services and information systems that we may become aware of in the future, or there may be delays in developing patches that can be effectively deployed to address vulnerabilities. 

We will continue to make prioritization decisions based on, among other things, our available resources, the efficacy of our security tools, and the increasing workload to meet certain  security obligations, to determine which vulnerabilities or security defects to fix and the timing of these fixes, which could result in an exploit that compromises security. In some cases, customers are responsible for installing our software updates, and until they do so, their service remains subject to the vulnerabilities addressed in the software update. Vulnerabilities and critical security defects, errors in remediating vulnerabilities or security defects, failure of third-party providers to remediate vulnerabilities or security defects, or customers not deploying security releases or deciding not to install software updates could result in claims of liability against us, damage our reputation, or otherwise harm our business. 

Security incidents and vulnerabilities, and concerns regarding privacy, data protection, and information security may also prevent some of our customers and users from using or cause some of our customers and users to stop using our solutions and fail to upgrade or renew their subscriptions. Failures to meet customers’ and users’ expectations with respect to security and confidentiality of their data and information could damage our reputation and affect our ability to retain customers and users, attract new customers and users, and grow our business.

In addition, cybersecurity events or security vulnerabilities could result in breaches of our agreements with customers, lawsuits against us (including class action litigation), regulatory investigations or actions, and significant increases in costs, including costs for remediating the effects of