Zoom patches critical unauthenticated privilege escalation in Workplace for Windows
Original title: Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation
CVE-2026-108186 (CVSS 9.6) affects 7.1.0 before 7.1.8; CVE-2026-108187 (CVSS 8.1) affects builds before 7.1.5.
Zoom released updates for two flaws in Zoom Workplace for Windows that let an unauthenticated user escalate privileges over the network. CVE-2026-108186 is improper input validation scored 9.6 and affects versions from 7.1.0 before 7.1.8. CVE-2026-108187 is an origin-validation issue scored 8.1 and affects versions before 7.1.5. Zoom does not say the flaws are exploited; users are advised to apply the latest patches.
Unconfirmed: Zoom does not say whether either vulnerability is being exploited.
- Neither flaw requires special permissions or prior access, Zoom's disclosure says.
- CVE-2026-108186 covers Workplace for Windows from 7.1.0 before 7.1.8.
- CVE-2026-108187 covers Workplace for Windows before version 7.1.5.
- A separate July flaw, CVE-2026-53412, is mentioned only as earlier history.
Impact: Unauthenticated remote privilege escalation over the network
| Product | Affected | Fixed in |
|---|---|---|
| Zoom Workplace for Windows | 7.1.0 before 7.1.8 (CVE-2026-108186) | 7.1.8 |
| Zoom Workplace for Windows | before 7.1.5 (CVE-2026-108187) | 7.1.5 |
- 1.Apply the latest Zoom Workplace for Windows patches.
- Vendors
- Zoom
- Products
- Zoom Workplace for Windows
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-108186+1 related CVE | Improper input validation privilege escalation in Zoom Workplace for Windows | 9.6 group max | — |
From the original article
1 min read at thehackernews.com
Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems. The vulnerabilities are listed below - CVE-2026-108186 (CVSS score: 9. 6) - An improper input validation vulnerability that could allow an unauthenticated user to conduct an escalation of privilege via
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.