Zoom Workplace for Windows 7.1.8 Fixes CVE-2026-108186 Critical Escalation of Privilege
Do Son 
TL;DR
Zoom published two security bulletins on November 10, 2026, for Zoom Workplace for Windows. The worst flaw, CVE-2026-108186, carries a Critical CVSS score of 9.6. A second bug, CVE-2026-108187, scores 8.1. Both allow escalation of privilege over the network.
Two flaws in Zoom Workplace for Windows let an unauthenticated attacker escalate privileges via network access. Version 7.1.8 fixes both. Update the Windows client now.
- Product: Zoom Communications Zoom Workplace
- Vulnerabilities: 2 flaws (CVE-2026-108186, CVE-2026-108187)
- Highest severity: 9.6 (Critical · CVSSv3)
- Status: No confirmed exploitation yet; patches available
- Action: Update to 7.1.8, 7.1.5 now
| CVE | CVSS (CVSSv3) | Fixed in | Status |
|---|---|---|---|
| CVE-2026-108186 | 9.6 | 7.1.8 | Not exploited |
| CVE-2026-108187 | 8.1 | 7.1.5 | Not exploited |
Why It Matters
Neither flaw requires a login. However, both CVSS vectors require user interaction, so the victim must take some action first. Zoom has not shared which action triggers either bug. So far, Zoom has not reported any exploitation, and no public proof of concept has surfaced. Neither CVE appears in CISA’s Known Exploited Vulnerabilities catalog.
How the Attack Works
CVE-2026-108186: improper input validation
The Zoom security bulletin ZSB-26023 states that “Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.” Its scope-changed CVSS vector means the impact can reach beyond the Zoom app itself. Zoom Offensive Security found the bug internally.
CVE-2026-108187: origin validation error
Meanwhile, Zoom bulletin ZSB-26024 describes an “Origin Validation Error” with the same outcome. A researcher known as shmoul reported it.
Affected Versions
- CVE-2026-108186: Zoom Workplace for Windows 7.1.0 up to, but not including, 7.1.8
- CVE-2026-108187: Zoom Workplace for Windows before 7.1.5
Patch and Mitigation
Install Zoom Workplace for Windows 7.1.8 or later to close both gaps. Zoom advises that users “can help keep themselves secure by applying the latest updates available at https://zoom.us/download.” Admins should also push the update through their software deployment tools.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
