Zoom publishes patches for CVE-2026-108186 and CVE-2026-108187 in Zoom Workplace for Windows

Zoom has published corrections for two security vulnerabilities in Zoom Workplace for Windows that, according to official notices, allow a remote attacker to scale privileges without prior authentication. The problems are recorded as CVE-2026-108186 (CVSS 9.6) and CVE-2026-108187 (CVSS 8.1) and affect different branches of the client's line 7.1: the first impacts versions from 7.1.0 to 7.1.7 inclusive, and the second affects versions prior to 7.1.5; Zoom has published patches that correct both failures. These are the notes confirmed by the company and by the public vulnerability entries: CVE-2026-108186 is a return validation vulnerability that can allow for the escalation of privileges via network access, and CVE-2026-108187 is a source validation failure with the same general effect. The public information of Zoom and the CVE records are available for technical details and correction states, for example in the Zoom Security Centre and the MITRE CVE database: https: / / explore.zoom.us / en / security / and https: / / cve.mitre.org / cgi-bin / cvename.cgi? name = CVE-2026-108186.

Technically, both vulnerabilities are classified as validation problems: the first (improper input validation) indicates that the client code does not correctly check incoming data before processing them, which may allow a remote actor to cause unintended behaviour (reading or execution out of context) and, consequently, to raise privileges. The second (origin validation) suggests that the customer trusts origins or headers without verifying their authenticity, allowing manipulated requests to appear legitimate and to reach code with greater privileges. In practice, this means that an attacker who can communicate with the affected component of the Zoom client by network (local or remote, depending on the configuration and exposure of the equipment) could execute actions in the system with rights higher than those of the committed process.

Facts confirmed: Zoom released updates that correct CVE-2026-108186 and CVE-2026-108187; public CVSS are 9.6 and 8.1 respectively; the affected versions correspond to 7.1.x as indicated and the company has not reported active exploitation in nature until the patch is published. In addition, in July the company had already patched another critical vulnerability in the same product family (CVE-2026-53412, CVSS 9.8), which shows a high severity pattern in recent customer failures for Windows.

What is still to be confirmed or is reasonable estimate: Zoom has not provided public details on the exact complexity of the operation, whether there are public or private exploits circulating, or whether the operation requires access to the local network, services exposed on the Internet or specific conditions of the system (for example, specific firewall configurations). By the nature described - "escalation of privileges via network access" - it can be estimated that an attacker needs to reach a port or customer interface that processes network requests; however, if these interfaces are restricted by corporate policies or firewalls, the practical risk decreases. It is also uncertain which concrete persistence vectors or payloads would allow each actual operating failure to be executed.

Who does this affect? Mainly to organizations and users who run Zoom Workplace on Windows and who have not applied the corrections. Since the threat allows for the escalation of privileges without authentication, equipment managed with laxa network policies or with customers who accept network connections by default are the most exposed. In corporate environments, a team engaged by this track could be pivot for broader attacks on the internal network; in personal equipment, the threat is limited to the scope of what an attacker gets with the high privileges (malware installation, file modification, activity record, etc.).

Potential real consequences include system engagement with high privileges, persistent malware installation, local credentials extraction and side movement on corporate networks. The gravity indicated by the CVSS reflects that, if exploited in environments without mitigation, these failures could allow attackers to run code with higher privileges than the user's and evade controls that depend on the operating system's privilege model.

Specific and prioritized actions to be taken by the reader right now: 1) Apply patches immediately. Update Zoom Workplace for Windows to the version Zoom publishes as corrected (install version 7.1.8 or later if your environment allows and verify that both CVE are covered). For corporate environments, deploy the update through your patch management system or through the official MSI installers and validate the installer hash where possible. 2) Forging and verifying the policy of automatic updates in customers to reduce the exposure window. 3) Review and tighten network controls: block or limit access to video conferencing client services from unreliable networks, apply segmentation so that user customers do not expose management interfaces directly to the Internet and review firewall rules to mitigate attempts at access from non-corporate networks. 4) Monitoring and identifying indicators: examine EDR / antivirus records, win32 service creation events, unusual privilege elevations and network traffic to / from endpoints Zoom out of the ordinary. (5) Evidence and audit: run a vulnerability scan in your device park to identify Zoom facilities with affected versions and to remedy them as a matter of priority.

If you cannot apply the patch immediately, reduce the risk by limiting the exposure of the equipment with Zoom: disable unnecessary customer services, close ports that the customer should not expose and implement restricted execution policies. For managers, it is recommended to coordinate with the security team the creation of temporary detection rules in EDR and IMS that alert about typical privilege climbing behaviors (system account creation, ACLs modification, persistence via services).

In short, updating is the priority measure and not an option. These vulnerabilities have high scores and allow for the escalation of privileges without authentication, so any Windows equipment with 7.1.x versions of Zoom Workplace that has not been patched must be treated as high risk until the remediation is confirmed. For more information and checking of patch states, see the official Zoom security pages and public CVE entries: https: / / explore.zoom.us / en / security / and https: / / cve.mitre.org / cgi-bin / cvename.cgi? name = CVE-2026-108187.