Zoom fixes critical Windows flaws enabling remote privilege escalation

Zoom has released fixes for two critical flaws in Zoom Workplace for Windows that could allow unauthenticated remote privilege escalation. The vulnerabilities, CVE-2026-108186 and CVE-2026-108187, both involve network-based attack paths that could let an attacker escalate privileges without any special permissions. CVE-2026-108186 is described as an improper input validation weakness (CVSS 9.6), while CVE-2026-108187 is an origin validation weakness (CVSS 8.1). Exploitation of either flaw could enable remote attackers to gain higher privileges on affected systems.

The patched versions affect Zoom Workplace for Windows in different ranges: CVE-2026-108187 impacts Zoom Workplace for Windows before version 7.1.5, and CVE-2026-108186 affects versions starting from 7.1.0 and before 7.1.8. Zoom had previously addressed another input-validation vulnerability in July 2026 (CVE-2026-53412, CVSS 9.8) that could let an unauthenticated user take control of accounts.

The company notes it has not stated that these new flaws are being exploited in the wild, but users are advised to apply the latest patches to mitigate potential threats. The article attributes the details to Zoom’s security bulletins linked in the report.