Zoom Workplace Flaw CVE-2026-108186: Update on Windows
Zoom released updates fixing two flaws in Zoom Workplace for Windows, including the critical `CVE-2026-108186` (CVSS 9.6), which could let an unauthenticated user escalate privileges over the network.
⚡ Why it matters
Zoom runs on millions of work and school PCs, and the flaw needs no account or special permissions, so updating matters even without known exploitation.
Zoom disclosed two flaws in Zoom Workplace for Windows:
CVE-2026-108186(CVSS 9.6): improper input validation that could let an unauthenticated user escalate privileges via network access. It affects versions 7.1.0 up to, but not including, 7.1.8.CVE-2026-108187(CVSS 8.1): an origin validation flaw that also leads to privilege escalation. It affects versions before 7.1.5.
Exploiting either could let a remote attacker raise privileges without any prior access or permissions.
Is it exploited?
Zoom has not reported in-the-wild exploitation but advises updating. In July, it fixed a similar flaw in the same app (CVE-2026-53412, CVSS 9.8) that allowed account takeover.
What to do
- In Zoom, click your profile picture, choose Check for Updates and install 7.1.8 or later.
- IT teams should push the update centrally through Intune or their device management tool and confirm no old versions remain.
- Download Zoom only from the official site and ignore update links sent by email or chat.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Critical CVEs: Synology, SharePoint, VS Code and Routers
Here are the most important critical vulnerabilities published in the US NVD between November 9 and 15, 2026, from Synology and Microsoft to developer tools, WordPress plugins and old home routers, with what to do for each.
Claude 'Office Party' Skills Flaw Runs Code on Linux
AIR Security disclosed Office Party, a flaw in Claude's official Word, PowerPoint and Excel skills that can run malicious code on Linux once a file is planted in a shared temp folder. Anthropic has chosen not to fix it.
Windows Paint Flaw CVE-2026-83844: Update via the Store
Microsoft patched a remote code execution flaw, `CVE-2026-83844`, in Windows Paint after nearly a month of confusion over the fixed version and its Store availability. The safe version is 11.2609.401.0.