Zoom Workplace for Windows: Update to 7.1.8 or Later for CVE-2026-108186 (9.6) and CVE-2026-108187 (8.1). Zoom's Own Scores Say the Victim Has to Do Something
If your people run the Zoom Workplace app on Windows, get every machine to version 7.1.8 or later. Zoom published two bulletins on November 10. One flaw, CVE-2026-108186, is rated Critical at 9.6 out of 10 and affects versions 7.1.0 up to 7.1.8. The other, CVE-2026-108187, is rated High at 8.1 and affects every version before 7.1.5. A machine on 7.1.5, 7.1.6 or 7.1.7 is clear of the second flaw but still exposed to the first, so "we updated last month" may not be enough. Zoom reports no attacks, and neither flaw is in CISA's Known Exploited Vulnerabilities catalog.
What Zoom says
The primary sources are Zoom's two security bulletins, which we read directly.
ZSB-26023, CVE-2026-108186, Critical, 9.6. Zoom's description, in full: "Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access." Affected: "Zoom Workplace for Windows starting on version 7.1.0 and before version 7.1.8." Reported by Zoom Offensive Security, Zoom's own team.
ZSB-26024, CVE-2026-108187, High, 8.1. Zoom's description: "Origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access." Affected: "Zoom Workplace for Windows before version 7.1.5." Reported by a researcher credited as "shmoul".
Fixed versions: neither bulletin names one. Both say users "can help keep themselves secure by applying the latest updates available at https://zoom.us/download". The affected ranges end before 7.1.8 and before 7.1.5, so 7.1.8 or later clears both. That is our reading of Zoom's ranges, not a version Zoom printed.
Attacks and exploit code: neither bulletin mentions exploitation in the wild or a public proof of concept. Both are revision 1.0, initial publication, dated November 10, 2026.
Where the press and the bulletin part ways
The Hacker News headline calls CVE-2026-108186 an "unauthenticated remote privilege escalation", and that matches Zoom's description word for word. What the description leaves out is in Zoom's own score. Both bulletins publish a CVSS 3.1 vector, and both contain UI:R, which means user interaction is required. The full vectors are CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H for the 9.6 and CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N for the 8.1. Read plainly: an attacker with no account, over the network, but someone on the target machine has to do something first, such as opening a link, a message or a meeting. Zoom does not say what that action is. The 9.6 also carries S:C, a scope change, meaning the damage can reach beyond the Zoom app itself.
So this is not a flaw an attacker can fire at a Windows machine that sits idle. It is the kind a phishing message or a meeting invite delivers. That makes it no less urgent: getting a person to click is the cheapest step in most intrusions.
The Hacker News report also matches Zoom on versions, scores and the absence of known exploitation. It adds context from July, when Zoom fixed a separate 9.8-rated Windows flaw, CVE-2026-53412.
What to do
Find every Windows machine running Zoom Workplace and its version. Your device management tool or software inventory is the place to look. Any version from 7.1.0 through 7.1.7 has the 9.6 flaw; anything older than 7.1.5 has the 8.1 flaw.
Update to 7.1.8 or later from zoom.us/download, or push it through your management tool. If you have turned off Zoom's automatic updates, this is the release to push by hand.
Do not count a machine as fixed because it reported an update in the last few weeks. 7.1.5 through 7.1.7 still carry CVE-2026-108186.
Until a machine is updated, treat unexpected Zoom links and meeting invites from outside your organization with extra suspicion. Both flaws need the user to act.
What is not known
What the user action is, and what an attacker gains after escalating. Zoom gives no technical detail beyond the one-sentence descriptions. Whether exploit code exists: our exploit harvester holds no repository for either CVE identifier as of this writing, and that harvester only finds repositories named for a CVE, so a zero is not proof of absence. Whether anyone is exploiting either flaw: Zoom says nothing, and CISA's catalog, version 2026.11.10 with 1,779 entries, lists neither CVE and no Zoom product at all.
How we know, and how we checked
We read Zoom's bulletins ZSB-26023 and ZSB-26024 directly, including the CVSS vectors, and The Hacker News report of November 11. We checked the CISA catalog in its JSON form. We tested nothing and run no vulnerable build. Our edge telemetry cannot see this: it watches web requests to our own sites, and these are flaws in a desktop app on the victim's machine, so there is nothing for it to match. That is a blind spot, not a clean result. We add no indicators to our feed: neither source publishes an IP address, domain or file hash, and none were published in the sources we read.
Sources
Zoom Security Bulletin ZSB-26023, "Zoom Workplace for Windows - Improper Input Validation," November 10, 2026. Zoom Security Bulletin ZSB-26024, "Zoom Workplace for Windows - Origin Validation Error," November 10, 2026. Both at zoom.com/trust/security-bulletin. CISA Known Exploited Vulnerabilities catalog, JSON feed, version 2026.11.10. The Hacker News, "Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation," November 11, 2026.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments