Critical Zoom Workplace Vulnerability Allows Unauthenticated Privilege Escalation (CVSS 9.6)

On November 10, 2026, Zoom Communications released out-of-band security updates closing two vulnerabilities in the Zoom Workplace desktop app for Windows. The main one — CVE-2026-108186 — received a near-maximum CVSS 3.1 score of 9.6 (Critical). It lets an attacker with no account and no authentication escalate privileges on the target system over the network.

The vulnerability is classified as improper input validation (CWE-20). Simply put, the app doesn't carefully enough validate data it receives from the network, opening the path to privilege escalation — a class of attacks that lets an ordinary user gain administrator or system rights.

Tellingly, the vulnerability was found by the internal Zoom Offensive Security team — a unit the company itself created to attack its own products before real attackers do. No signs of active in-the-wild exploitation were recorded at publication, and the flaw isn't yet in CISA's Known Exploited Vulnerabilities (KEV) catalog. But that's no reason to delay updating: the history of similar Zoom flaws shows attackers react to patch publication quickly.

Why does this news deserve attention right now? First, a 9.6 score places the vulnerability in a small group of the year's "most serious" issues. Second, it's not some exotic server component but a mass client app on millions of workstations, including Ukrainian ones. Third, there's no authentication requirement — the attacker needs neither the victim's account nor any Zoom account at all.

Two vulnerabilities — a technical breakdown

The November 10 update closes two flaws, both affecting only the Windows version of Zoom Workplace.

CVE-2026-108186 (CVSS 9.6, Critical) — an input-validation error. Vulnerable versions: from 7.1.0 up to but not including 7.1.8. In other words, if you have Zoom Workplace for Windows 7.1.0–7.1.7 installed, you're at risk. The fix is in version 7.1.8. Attack vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.

CVE-2026-108187 (CVSS 8.1, High) — an origin-validation error (CWE-346). All Zoom Workplace for Windows versions up to 7.1.5 are vulnerable. This flaw was found by an independent researcher under the pseudonym shmoul — another argument for the bug-bounty programs Zoom actively supports. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N.

The key common trait of both issues: PR:N (No Privileges Required) — the attacker needs no account. Network access to the target is enough to launch the exploit, and attack complexity is rated low (AC:L).

Why 9.6: breaking down the CVSS vector

To grasp how serious this is, let's break down CVE-2026-108186's vector element by element:

• AV:N (Attack Vector: Network) — the attack goes over the network; the attacker needs no physical access to the victim's computer.
• AC:L (Attack Complexity: Low) — no special conditions or "perfect" moment needed for successful exploitation.
• PR:N (Privileges Required: None) — no prior access or account.
• UI:R (User Interaction: Required) — the only restraining factor: the victim must perform some action (e.g., open a malicious link or accept a call invitation). Zoom doesn't specify which.
• S:C (Scope: Changed) — the most alarming element. It means the vulnerable component (the Zoom client) can be used as a "springboard" to affect other system components — hence privilege escalation rather than an ordinary crash.
• C:H / I:H / A:H — high impact on confidentiality, integrity, and availability.

It's the combination of "network + no privileges + changed scope + full impact" that yields such a high score. By comparison, the second vulnerability (CVE-2026-108187) got a lower 8.1 because its scope is unchanged (S:U) and it doesn't affect availability (A:N).

What a real attack might look like

Although Zoom doesn't disclose exploit technical details (to avoid handing attackers ready tooling before everyone updates), the vulnerability class lets us sketch the attack scenario.

The attacker can send the target a malicious network packet or a specially formed link. Since no authentication is needed, the attacker can act even without any meeting invitation — it's enough that the user "bites" on the right action (e.g., clicks a link disguised as a call invitation). After exploitation, the attacker can run code with higher privileges than intended — a path to installing malware, stealing data, or full machine control.

Separately, note: both vulnerabilities concern the Windows client. macOS, Linux, iOS, and Android users don't need this specific patch for these CVEs, but the general advice to update Zoom to the latest version remains valid for all platforms.

Who's at risk

Zoom Workplace is one of the world's most widespread video-communication tools. In Ukraine it's actively used by companies, government bodies, educational institutions, and private users — from daily work meetings to online university lectures. That means the potential "attack surface" is enormous.

Special attention should go to organizations where Windows machines run under accounts with local administrator rights — a common practice that makes privilege escalation instant. Companies should also check whether old Zoom versions (7.1.0–7.1.7) are installed on corporate devices — especially rarely updated machines or "frozen" images.

If you or your colleagues suspect credentials may have been compromised in past incidents, check them via the free cyberpeople.tech breach check.

What to do: update to version 7.1.8

The most important — and essentially only complete — protection measure is to update Zoom Workplace for Windows to 7.1.8 or newer. There are several ways:

1. Auto-update. Open Zoom → click your profile avatar → "Check for Updates." The app downloads and installs the patch itself.
2. Manually. Download the latest installer from the official zoom.us/download center and install over the existing version.
3. For corporate admins. Deploy the update via centralized management (MSI/mass deployment) and force-update all clients, including those on rarely used workstations.

A few important nuances:

• Updating only stops further exploitation. If a machine was already compromised, the patch won't roll back changes — new local admins, installed software, or running processes will remain. So after updating, check the local administrators group for unknown accounts.
• Version 7.1.8 only closes CVE-2026-108186. For CVE-2026-108187, 7.1.5 suffices, but updating to 7.1.8 closes both at once.
• Don't download installers from third-party sites — only from the official zoom.com/zoom.us domain, to avoid a "poisoned" distribution.

Who found the flaws and why it matters

It's worth noting how both issues were discovered. The critical CVE-2026-108186 was found by Zoom's own Offensive Security team — the company's internal red team that attacks its own products using real-attacker methodology. The second flaw, CVE-2026-108187, was found by an independent researcher under the pseudonym shmoul — likely through the public bug-bounty program Zoom runs for external researchers.

This is a good illustration of how a "two-layer" security model — an internal offensive unit plus rewards for external researchers — finds vulnerabilities before criminal groups do. Thanks to that approach, both flaws were fixed and disclosed in a controlled manner, with no signs of in-the-wild exploitation.

For Ukrainian companies this is also a practical lesson: running your own bug-bounty program, or at least a responsible-disclosure channel, is far cheaper than handling the fallout of a real breach.

Checklist for administrators

If you're responsible for a fleet of Windows devices, here's a step-by-step plan for the next 24 hours:

1. Inventory versions. Build a list of all machines with Zoom Workplace installed and identify which run 7.1.0–7.1.7.
2. Deploy 7.1.8. Use centralized deployment (MSI, Intune, SCCM, or MDM), force-updating all clients, not just actively used ones.
3. Check local privileges. After updating, check local-administrator groups on key machines for unknown accounts — the patch doesn't undo actions an attacker already took.
4. Repeat regularly. Establish a rule: critical patches apply out-of-band, not only within the monthly "update window."

Why this matters and the takeaway

This isn't the first time Zoom has faced critical input-validation issues in its Windows client. In July 2026 the company patched CVE-2026-53412 (CVSS 9.8) — likewise an input-validation error in Zoom Workplace for Windows that let an unauthenticated user take over accounts. The recurrence of such flaws within months is a reminder that even mature, popular products need regular updating, not just reaction to a specific incident.

Main takeaways for users and business:

• Update immediately. The 9.6 criticality and lack of an authentication requirement are enough reason not to wait for a scheduled update window.
• Minimize privileges. Don't run everyday work accounts with admin rights — this sharply reduces the effect of any privilege escalation.
• Track vendor updates. Subscribe to the security bulletins of software you use; for Zoom it's the Security Bulletins page on zoom.com.
• Raise team awareness. Most such attacks require the user to perform an action (UI:R), so basic cyber hygiene — don't open suspicious links — remains the first line of defense. For those wanting to systematically raise their team's level, our cybersecurity learning material helps.

The critical Zoom Workplace vulnerability is a vivid reminder that even the most convenient everyday tool needs the same security attention as any server software. Updating to 7.1.8 takes a few minutes but can protect an entire workstation from compromise.