Zoom patches two Windows Workplace privilege-escalation flaws
Original title: Zoom Fixes Critical Windows Vulnerability Allowing Privilege Escalation
CVE-2026-108186 scores 9.6 and CVE-2026-108187 scores 8.1; Zoom reports no known attacks.
Zoom released updates for two flaws in Zoom Workplace for Windows that could let unauthenticated attackers raise privileges over the network. CVE-2026-108186, an input-validation bug scored 9.6, affects versions from 7.1.0 before 7.1.8. CVE-2026-108187, an origin-validation bug scored 8.1, affects releases earlier than 7.1.5. Zoom says it is not aware of exploitation.
Unconfirmed: Zoom says it is not aware of attacks; a repeated memory-corruption passage may describe an earlier flaw.
- Zoom's internal team found the first flaw; researcher shmoul reported the second.
- Either bug can raise privileges without an account or special permissions.
- The article also recalls earlier fixes for CVE-2026-53413 and CVE-2026-53412.
Impact: Unauthenticated remote privilege escalation on Windows
| Product | Affected | Fixed in |
|---|---|---|
| Zoom Workplace for Windows | 7.1.0 up to, but not including, 7.1.8 | 7.1.8 |
| Zoom Workplace for Windows | earlier than 7.1.5 | 7.1.5 |
- 1.Install the latest Zoom Workplace for Windows updates.
- Vendors
- Zoom
- Products
- Zoom Workplace for Windows
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-108186+1 related CVE | Improper input validation privilege escalation in Zoom Workplace for Windows | 9.6 group max | — |
From the original article
2 min read at securityaffairs.com
Zoom fixes two Windows Workplace flaws, including a critical bug that could let unauthenticated attackers remotely escalate privileges. Zoom has released security updates to fix two vulnerabilities in Zoom Workplace for Windows. One is critical and could let attackers gain higher privileges on affected systems.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.