Zoom Workplace for Windows CVE-2026-108186 (CVSS 9.6): Unauthenticated Network Privilege Escalation Fixed in 7.1.8

Cyber · 2026-11-13 · By H.A

Zoom Workplace for Windows CVE-2026-108186 (CVSS 9.6): Unauthenticated Network Privilege Escalation Fixed in 7.1.8

Zoom has patched a critical improper input validation flaw (CVE-2026-108186) and a high-severity origin validation bug (CVE-2026-108187) in its Windows client that allow unauthenticated privilege escalation, with version 7.1.8 fixing both.

What Happened

Zoom has released security updates for Zoom Workplace for Windows that fix two privilege-escalation flaws. The more serious one, CVE-2026-108186, is rated critical at 9.6 on the CVSS scale. Zoom says it can let an unauthenticated user escalate privileges over network access. The bulletins were published on 10 November 2026, and the fix is in Zoom Workplace for Windows 7.1.8.

The second flaw, CVE-2026-108187, is rated high (8.1) and also allows unauthenticated privilege escalation through the network.

Zoom has not reported exploitation in the wild, and neither CVE is in CISA's Known Exploited Vulnerabilities catalogue so far.

Technical Details

Zoom's bulletins are short, as usual, and no technical write-up or proof of concept has been published. What is known:

A score of 9.6 with a network vector and no authentication usually means an attacker can reach the vulnerable code remotely, typically through crafted meeting content, links or messages, and that user interaction may still be needed. Zoom hasn't said what "privileges" are gained. On a Windows desktop client, the realistic worst case is control of the user's Zoom session and data, and possibly a foothold on the endpoint.

A Pattern of Input-Validation Bugs

This is not the first critical input-validation bug in the Windows client this year. In July 2026, Zoom patched CVE-2026-53412 (CVSS 9.8), another improper input validation flaw in Zoom Workplace for Windows that could let an unauthenticated user take over accounts. Repeated critical bugs in the same component suggest that how the Windows client parses untrusted network input is still a weak spot.

Who Is Affected

Large organisations often have the biggest gap: users who decline update prompts, VDI images that are rarely rebuilt, and kiosk or meeting-room PCs that nobody updates.

Patch Status

Zoom Workplace for Windows 7.1.8 fixes CVE-2026-108186 and also covers CVE-2026-108187. There are no published workarounds, so updating is the only fix.

What To Do Now

Individual users: open Zoom, click your profile picture, choose Check for Updates, install 7.1.8 or later and restart the client.

IT administrators:

Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,
  HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*,
  HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue |
  Where-Object DisplayName -like "Zoom*" | Select-Object DisplayName, DisplayVersion

Any DisplayVersion below 7.1.8 needs updating. Per-user installs live under HKCU and in %APPDATA%\Zoom, so run the check in each user's context or use your endpoint tool's software inventory.

Until every client is updated, remind staff to be careful with meeting links and chat files from unknown senders, and watch EDR alerts for unusual child processes started by Zoom.exe.

Why It Matters

Video-conferencing clients sit on almost every corporate laptop, handle untrusted content from outside participants all day, and are often left to update themselves. That makes them attractive targets. A critical flaw needing no authentication is the kind attackers try to reverse-engineer from the patch once it ships. Even without exploitation reports, the 9.6 score and the history of similar bugs make this a fast-patch item. Getting every Windows endpoint to 7.1.8 this week is the sensible goal.

REEF SENTINEL