Zoom fixes two Windows flaws enabling privilege escalation

Zoom Workspace for Windows has two newly disclosed privilege-escalation flaws, fixed in version 7.1.8 and earlier updates. On 10 November 2026, Zoom published security bulletins confirming CVE-2026-108186 (CVSS v3 score 9.6) and CVE-2026-108187 (score 8.1). Both flaws allow escalation of privileges over the network without requiring a login, though each vector requires some user interaction. The company states there is no confirmed exploitation at present and no public proof of concept has emerged. Patches are available; users should update to Zoom Workplace for Windows 7.1.8 or later (and 7.1.5 for the second CVE).

CVE-2026-108186 is described as improper input validation that may permit unauthenticated privilege escalation via network access, with Zoom Offensive Security identifying the flaw internally. CVE-2026-108187 is an origin validation error reported by a researcher known as shmoul, also leading to the same escalation outcome. Affected versions are Zoom Workplace for Windows 7.1.0 up to, but not including, 7.1.8 for CVE-2026-108186, and Zoom Workplace for Windows before 7.1.5 for CVE-2026-108187.

The guidance from Zoom is clear: install Zoom Workplace for Windows 7.1.8 or later and administer updates through standard deployment tools. The article notes that neither CVE appears in CISA’s Known Exploited Vulnerabilities catalog at this time.