Disclosure: this page contains affiliate links. East Bay Cyber may earn a commission if you buy through them, at no extra cost to you. That never changes how we rank products. Editorial policy.
Zoom Patches Critical Windows Privilege-Escalation Flaw
TL;DR - Zoom published fixes on 11/10/2026 for two Zoom Workplace for Windows vulnerabilities. - CVE-2026-108186 is rated Critical, with a CVSS score of 9.6. - CVE-2026-108187 is rated High, with a CVSS score of 8.1. - Zoom recommends applying the latest updates available through its download page. - No exploitation in the wild has been stated by Zoom, according to SecurityWeek and The Hacker News.
What happened#
Zoom published two security bulletins for Zoom Workplace for Windows on 11/10/2026.
The first, ZSB-26023, covers CVE-2026-108186, an improper input validation vulnerability. Zoom rates it Critical and assigns it a CVSS score of 9.6. The bulletin says the flaw may allow an unauthenticated user to conduct an escalation of privilege via network access.
The affected product range is Zoom Workplace for Windows starting on version 7.1.0 and before version 7.1.8. Zoom says users can help keep themselves secure by applying the latest updates available at https://zoom.us/download.
The second, ZSB-26024, covers CVE-2026-108187, an origin validation error. Zoom rates this issue High and assigns it a CVSS score of 8.1. Zoom describes it as potentially allowing an unauthenticated user to conduct an escalation of privilege via network access.
CVE-2026-108187 affects Zoom Workplace for Windows before version 7.1.5. Zoom also recommends applying the latest available updates for this issue.
Zoom’s security bulletin index lists both bulletins as published and updated on 11/10/2026.
Are you affected#
Organizations are potentially affected if they use Zoom Workplace for Windows in either of the affected ranges:
- For CVE-2026-108186, versions starting on 7.1.0 and before version 7.1.8.
- For CVE-2026-108187, versions before version 7.1.5.
The advisories do not publish a separate fixed-version statement for each vulnerability. SecurityWeek reports that Zoom Workplace for Windows versions 7.1.8 and later contain patches for both bugs. That statement is not included in the individual Zoom bulletins.
The Zoom bulletins do not provide guidance on vulnerability impacts to individual customers or additional details about a vulnerability. They do state that the issues can involve an unauthenticated user and network access.
What is confirmed and what is reported#
| Claim | Source | Status |
|---|---|---|
| CVE-2026-108186 affects Zoom Workplace for Windows starting on version 7.1.0 and before version 7.1.8. | Zoom | Confirmed |
| CVE-2026-108186 is rated Critical and has a CVSS score of 9.6. | Zoom | Confirmed |
| CVE-2026-108186 is an improper input validation vulnerability that may allow an unauthenticated user to conduct an escalation of privilege via network access. | Zoom | Confirmed |
| CVE-2026-108187 affects Zoom Workplace for Windows before version 7.1.5. | Zoom | Confirmed |
| CVE-2026-108187 is rated High and has a CVSS score of 8.1. | Zoom | Confirmed |
| CVE-2026-108187 is an origin validation error that may allow an unauthenticated user to conduct an escalation of privilege via network access. | Zoom | Confirmed |
| Zoom Workplace for Windows versions 7.1.8 and later contain patches for both bugs. | SecurityWeek | Reported |
| Zoom has not mentioned either vulnerability being exploited in the wild. | SecurityWeek, The Hacker News | Reported |
| Successful exploitation could permit remote attackers to escalate privileges without special permissions or access. | The Hacker News | Reported |
What defenders should do now#
- Identify endpoints running Zoom Workplace for Windows and record their installed versions.
- Prioritize systems running versions starting on 7.1.0 and before version 7.1.8 for review against CVE-2026-108186.
- Prioritize systems running versions before 7.1.5 for review against CVE-2026-108187.
- Apply the latest Zoom updates available through the vendor’s download page at https://zoom.us/download, as recommended in both Zoom bulletins.
- Use the individual Zoom bulletin for CVE-2026-108186 and the Zoom bulletin for CVE-2026-108187 when documenting remediation.
- Continue monitoring Zoom’s security bulletin index for revisions or additional details.
This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.
Sources
- Primary notice: zoom.com
- Primary notice: zoom.com
- Primary notice: zoom.com
- Report: securityweek.com
- Report: thehackernews.com