Zoom fixes Windows flaws enabling unauthorised privilege escalation

Zoom has released security updates for Zoom Workplace on Windows to fix two flaws, one of which is classified as critical and could allow unauthenticated remote privilege escalation. The two vulnerabilities are CVE-2026-108186 (CVSS 9.6) and CVE-2026-108187 (CVSS 8.1). The first is an input-validation issue that could let an attacker gain higher privileges through a network connection without logging in, while the second is an origin-validation flaw that could enable unauthenticated remote privilege elevation.

Zoom states that, if exploited, either flaw could permit an attacker to raise privileges without an account or special permissions on the affected system. The company notes the first flaw was reported by its internal security team, and the second by a researcher referred to as “research shmoul”.

CVE-2026-108187 affects Zoom Workplace for Windows releases earlier than 7.1.5, while CVE-2026-108186 affects versions from 7.1.0 up to, but not including, 7.1.8. The flaws could corrupt memory via a specially crafted message, allowing attackers to target meeting participants, execute code without user interaction, steal data, activate cameras or microphones, and install malware.

This follows Zoom’s August patch cycle, which fixed four vulnerabilities including a critical zero-click flaw tracked as CVE-2026-53413, a memory-corruption issue that could let a participant execute code on another participant’s machine; that flaw was dubbed “Zoomsday” by researchers from A Security. Zoom also previously fixed CVE-2026-53412 in July, a critical account-takeover flaw affecting older Zoom components. Zoom says it is not aware of active exploits for the above vulnerabilities, and urges users to apply the latest updates.