Zoom patches critical unauthenticated privilege escalation in Workplace for Windows
CVE-2026-108186 (CVSS 9.6) affects 7.1.0 before 7.1.8; CVE-2026-108187 (CVSS 8.1) affects builds before 7.1.5.
66
CVE-2026-108186
Improper input validation privilege escalation in Zoom Workplace for Windows
- CVSS 3.1
- 9.6 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Improper input validation in Zoom Workplace for Windows lets an unauthenticated attacker escalate privileges over the network. The attack needs user interaction. A successful attack can change scope and fully compromise confidentiality, integrity, and availability. Only the Windows edition of Zoom Workplace is named as affected; Zoom has not listed affected builds.
What to do: Apply Zoom's update for CVE-2026-108186. No workaround is stated.
| Product | Affected |
|---|---|
| Zoom Workplace for Windows | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
- Weakness
- CWE-20
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
In the news
2 storiesAsus and Zoom patch router and Workplace privilege bugs
Zoom Workplace for Windows 7.1.8 fixes CVE-2026-108186 (CVSS 9.6) and CVE-2026-108187.
64