Zoom Communications Zoom Workplace flaw CVE-2026-108186 enables remote privilege escalation
TL;DR
Zoom Communications has released patches for two vulnerabilities in Zoom Workplace for Windows, including a critical flaw, CVE-2026-108186. This bug could allow an unauthenticated attacker to escalate privileges via network access. Update your Zoom client to version 7.1.8 or later immediately.
What happened
Zoom released software updates to address two security flaws impacting Zoom Workplace for Windows. The first, CVE-2026-108186, is an improper input validation vulnerability with a CVSS score of 9.6. The second, CVE-2026-108187, is an origin validation vulnerability with a CVSS score of 8.1.
Both vulnerabilities could allow an unauthenticated user to conduct an escalation of privilege via network access. Successful exploitation of either flaw could permit remote attackers to escalate privileges without requiring special permissions or access. These vulnerabilities were reported by Zoom Offensive Security.
Why it matters
The critical nature of CVE-2026-108186 stems from its ability to grant elevated privileges to an unauthenticated attacker through the network. Because the attack requires no special permissions, any user on the network could potentially escalate their access on a Windows machine running vulnerable versions of the software. This follows a similar high-severity flaw reported earlier this July that could have allowed account takeovers.
Who is affected
- Zoom Workplace for Windows: versions starting from 7.1.0 and before 7.1.8 (impacted by
CVE-2026-108186) - Zoom Workplace for Windows: versions before 7.1.5 (impacted by
CVE-2026-108187)
What to do now
- Update Zoom Workplace for Windows to version 7.1.8 or later.
- Verify that all Windows-based Zoom clients in your environment are running the latest available version.
What we don't know yet
- Whether these vulnerabilities are being exploited in the wild.
- The specific root cause of the improper input validation.
Sources
