Zoom patches two unauthenticated Workplace for Windows privilege bugs
First merged summary.
Zoom fixed two unauthenticated privilege-escalation flaws in Workplace for Windows; exploitation is not reported.
Zoom released patches for two flaws in Zoom Workplace for Windows that let an unauthenticated user escalate privileges over the network. CVE-2026-108186, improper input validation scored 9.6, affects versions from 7.1.0 before 7.1.8. CVE-2026-108187, an origin-validation issue scored 8.1, affects versions before 7.1.5. Versions 7.1.8 and later include both fixes. According to Zoom’s disclosure, neither flaw requires special permissions or prior access. Zoom does not say the flaws are exploited in the wild.
- CVE-2026-108186 is CVSS 9.6 and affects 7.1.0 before 7.1.8.
- CVE-2026-108187 is CVSS 8.1 and affects builds before 7.1.5.
- Workplace for Windows 7.1.8 and later include both fixes.
- Zoom does not report in-the-wild exploitation.
- Neither flaw requires special permissions or prior access, Zoom says.
What each outlet adds
beyond the shared facts- The Hacker NewsVersion ranges, flaw types, and no prior access required.
- SecurityWeek7.1.8 covers both fixes; Zoom omits exploitation.
Coverage
oldest first · one row per article · UTC- · 6h ago
SecurityWeekFirst report
Asus and Zoom patch router and Workplace privilege bugs
Zoom Workplace for Windows 7.1.8 fixes CVE-2026-108186 (CVSS 9.6) and CVE-2026-108187.
- · 4h ago
The Hacker News
Zoom patches critical unauthenticated privilege escalation in Workplace for Windows
CVE-2026-108186 (CVSS 9.6) affects 7.1.0 before 7.1.8; CVE-2026-108187 (CVSS 8.1) affects builds before 7.1.5.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-108186+1 related CVE | Improper input validation privilege escalation in Zoom Workplace for Windows | 9.6 group max | — |