Zoom Fixes Critical Windows Flaw Allowing Unauthenticated Privilege Escalation

Zoom has released security updates to fix two vulnerabilities in Zoom Workplace for Windows. CVE-2026-108186, rated CVSS 9.6, is an input validation flaw that could let an attacker gain higher privileges through a network connection without logging in. CVE-2026-108187, rated CVSS 8.1, is an origin validation flaw that could also let an unauthenticated attacker escalate privileges remotely.

According to Security Affairs, CVE-2026-108187 affects Zoom Workplace for Windows releases earlier than 7.1.5, while CVE-2026-108186 affects versions from 7.1.0 up to, but not including, 7.1.8. The first flaw was reported by Zoom's internal security team and the second by the researcher shmoul. Users are advised to install the latest Zoom Workplace updates.

Security Affairs also notes that in August Zoom patched a critical zero-click memory corruption flaw, CVE-2026-53413, found by A Security, and that in July it fixed CVE-2026-53412, a critical Windows flaw that could allow unauthenticated attackers to hijack user accounts. Zoom says it is not aware of attacks exploiting the newly fixed vulnerabilities.

Why it matters Organizations running Zoom Workplace on Windows should confirm which versions are deployed and apply the updates, since the critical flaw requires no account or special permissions to exploit according to the report. Investigators tracking the earlier Zoom flaws in August and July should treat this as a recurring pattern in the client's attack surface, with memory corruption and unauthenticated access both appearing in successive advisories.