Skip to content
Hacker Posts

Zoom patches critical Workplace for Windows privilege escalation

Zoom fixed two unauthenticated privilege-escalation flaws in Workplace for Windows — CVE-2026-108186 (CVSS 9.6) and CVE-2026-108187 (8.1). Update to 7.1.8. No in-the-wild reports.

Published 2 min read
cvezoomadvisorywindows

Zoom patched two vulnerabilities in Zoom Workplace for Windows that let an unauthenticated, remote attacker escalate privileges. The critical one, CVE-2026-108186, carries a CVSS of 9.6. Both are fixed in version 7.1.8. If you run the Windows desktop client, update this week.

The primary reference is Zoom's security bulletin index; the two CVEs were reported by The Hacker News and SecurityWeek.

What's affected

  • CVE-2026-108186 (CVSS 9.6, critical) — improper input validation in Zoom Workplace for Windows. An unauthenticated user can escalate privileges over the network.
  • CVE-2026-108187 (CVSS 8.1) — an origin-validation flaw that also allows an unauthenticated, remote attacker to elevate privileges.

The scope is the Windows desktop client only (Zoom Workplace for Windows). SecurityWeek reports that Workplace for Windows 7.1.8 and later contain patches for both bugs. Other Zoom clients are not named in this advisory.

Exploitation status

Zoom makes no mention of in-the-wild exploitation, and no public proof-of-concept was available at release. There is no named actor and no detection artifact shipped by the vendor — so there are no IOCs to publish. Treat this as a pre-exploitation patch window: both bugs are unauthenticated and network-reachable, which is exactly the profile attackers reverse-engineer from a diff once a fix ships.

Action checklist

  1. Update Zoom Workplace for Windows to 7.1.8 or later on every managed and BYOD endpoint. This closes both CVEs.
  2. Push the update through your MDM / software-deployment tooling rather than relying on client auto-update, which lags and can be disabled by users.
  3. Audit for stale installs. Query your endpoint inventory for Zoom Workplace builds below 7.1.8 and prioritize them.
  4. Confirm auto-update is enabled where you can't centrally manage the client, so the next client-side bug closes faster.

Context

This is the second notable unauthenticated flaw in the Windows client this year. In July, Zoom patched CVE-2026-53412 (CVSS 9.8), another improper-input-validation bug that could let an unauthenticated user take over accounts. The pattern is consistent — input and origin validation in the desktop client's network-facing surface — and it is a reminder that collaboration-suite endpoints are part of the attack surface, not just the servers behind them. The same SecurityWeek roundup paired these fixes with an Asus router advisory covering four high- and medium-severity firmware flaws; patch that gear on its own track if it's in your estate.

Related stories