Zoom Patches Critical Windows Vulnerability That Could Allow Remote Privilege Escalation

Zoom has released security updates addressing two vulnerabilities in Zoom Workplace for Windows, including a critical flaw that could allow unauthenticated attackers to escalate privileges on affected systems through network access.

The vulnerabilities could enable remote attackers to gain elevated privileges without requiring special permissions or prior authentication.

The two security issues are tracked as CVE-2026-108186 and CVE-2026-108187, with severity scores of 9.6 and 8.1, respectively.

Two Security Vulnerabilities Identified

According to Zoom's security advisories, the vulnerabilities are as follows:

1. CVE-2026-108186 (CVSS 9.6)

This critical improper input validation vulnerability could allow an unauthenticated attacker to perform privilege escalation through network access.

It affects Zoom Workplace for Windows versions starting from 7.1.0 and earlier than 7.1.8.

2. CVE-2026-108187 (CVSS 8.1)

This origin validation vulnerability could also allow an unauthenticated attacker to escalate privileges through network access.

It affects Zoom Workplace for Windows versions earlier than 7.1.5.

Successful exploitation of either vulnerability could allow attackers to obtain elevated privileges without requiring existing authentication or special access.

Previous Critical Zoom Vulnerability

This is not the first time Zoom has addressed a critical security issue affecting its Windows application.

In July 2026, the company patched another improper input validation vulnerability tracked as CVE-2026-53412, which received a CVSS score of 9.8.

That vulnerability could allow an unauthenticated attacker to take control of user accounts.

The latest disclosures highlight the importance of maintaining updated versions of widely used communication and collaboration software.

How to Stay Protected

Zoom has released software updates to address both vulnerabilities. Users and administrators should:

  • Update Zoom Workplace for Windows to version 7.1.8 or later.
  • Ensure that systems running older versions are upgraded.
  • Verify application versions across organizational endpoints.
  • Include Zoom Workplace in regular software patch management procedures.
  • Prioritize updates for systems exposed to untrusted networks.

Zoom has not reported whether either vulnerability has been exploited in real-world attacks.

Organizations are advised to apply the available security updates promptly to reduce the risk of potential privilege escalation attacks.