Zoom Workplace for Windows CVE-2026-108186 (CVSS 9.6): Unauthenticated Network Privilege Escalation Fixed in 7.1.8
Zoom has patched a critical improper input validation flaw (CVE-2026-108186) and a high-severity origin validation bug (CVE-2026-108187) in its Windows client that allow unauthenticated privilege escalation, with version 7.1.8 fixing both.
What Happened
Zoom has released security updates for Zoom Workplace for Windows that fix two privilege-escalation flaws. The more serious one, CVE-2026-108186, is rated critical at 9.6 on the CVSS scale. Zoom says it can let an unauthenticated user escalate privileges over network access. The bulletins were published on 10 November 2026, and the fix is in Zoom Workplace for Windows 7.1.8.
The second flaw, CVE-2026-108187, is rated high (8.1) and also allows unauthenticated privilege escalation through the network.
Zoom has not reported exploitation in the wild, and neither CVE is in CISA's Known Exploited Vulnerabilities catalogue so far.
Technical Details
Zoom's bulletins are short, as usual, and no technical write-up or proof of concept has been published. What is known:
- CVE-2026-108186 (ZSB-26023): improper input validation in Zoom Workplace for Windows. CVSS 9.6. Affects versions 7.1.0 up to, but not including, 7.1.8. An unauthenticated attacker with network access could escalate privileges.
- CVE-2026-108187 (ZSB-26024): an origin validation error, meaning the client doesn't properly check where a request comes from before acting on it. CVSS 8.1. Zoom lists versions before 7.1.5 as affected. Some reports describe the range differently, so check Zoom's bulletin for your build.
A score of 9.6 with a network vector and no authentication usually means an attacker can reach the vulnerable code remotely, typically through crafted meeting content, links or messages, and that user interaction may still be needed. Zoom hasn't said what "privileges" are gained. On a Windows desktop client, the realistic worst case is control of the user's Zoom session and data, and possibly a foothold on the endpoint.
A Pattern of Input-Validation Bugs
This is not the first critical input-validation bug in the Windows client this year. In July 2026, Zoom patched CVE-2026-53412 (CVSS 9.8), another improper input validation flaw in Zoom Workplace for Windows that could let an unauthenticated user take over accounts. Repeated critical bugs in the same component suggest that how the Windows client parses untrusted network input is still a weak spot.
Who Is Affected
- Anyone running Zoom Workplace for Windows 7.1.0 through 7.1.7 is exposed to CVE-2026-108186.
- Older installations before 7.1.5 are also exposed to CVE-2026-108187.
- Zoom has not listed macOS, Linux, iOS or Android clients in these two bulletins.
Large organisations often have the biggest gap: users who decline update prompts, VDI images that are rarely rebuilt, and kiosk or meeting-room PCs that nobody updates.
Patch Status
Zoom Workplace for Windows 7.1.8 fixes CVE-2026-108186 and also covers CVE-2026-108187. There are no published workarounds, so updating is the only fix.
What To Do Now
Individual users: open Zoom, click your profile picture, choose Check for Updates, install 7.1.8 or later and restart the client.
IT administrators:
- Push the 7.1.8 (or newer) MSI through Intune, SCCM, Group Policy or your RMM tool.
- Turn on automatic updates in the Zoom web portal for managed accounts so future fixes arrive without user action.
- Rebuild VDI golden images and update meeting-room and kiosk systems.
- Check your fleet for old versions. For example, query installed versions with PowerShell:
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,
HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*,
HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue |
Where-Object DisplayName -like "Zoom*" | Select-Object DisplayName, DisplayVersionAny DisplayVersion below 7.1.8 needs updating. Per-user installs live under HKCU and in %APPDATA%\Zoom, so run the check in each user's context or use your endpoint tool's software inventory.
Until every client is updated, remind staff to be careful with meeting links and chat files from unknown senders, and watch EDR alerts for unusual child processes started by Zoom.exe.
Why It Matters
Video-conferencing clients sit on almost every corporate laptop, handle untrusted content from outside participants all day, and are often left to update themselves. That makes them attractive targets. A critical flaw needing no authentication is the kind attackers try to reverse-engineer from the patch once it ships. Even without exploitation reports, the 9.6 score and the history of similar bugs make this a fast-patch item. Getting every Windows endpoint to 7.1.8 this week is the sensible goal.
