Critical Zoom Workplace Flaws Could Allow Unauthenticated Privilege Escalation

Zoom has released software updates to address two security flaws affecting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems. The vulnerabilities could allow an unauthenticated user to escalate privileges via network access. Zoom makes no mention of the flaws being exploited in the wild, but users are advised to apply the latest patches.

Two CVEs Disclosed

CVE-2026-108186 carries a CVSS score of 9.6 and is described as an improper input validation vulnerability. CVE-2026-108187 carries a CVSS score of 8.1 and is described as an origin validation vulnerability. Successful exploitation of either flaw could permit remote attackers to escalate privileges without requiring any special permissions or access.

Affected Versions

CVE-2026-108187 affects Zoom Workplace for Windows before version 7.1.5. CVE-2026-108186 impacts versions starting from 7.1.0 and before 7.1.8.

Earlier Fix This Year

Earlier this July, Zoom shipped fixes for another improper input validation flaw impacting Zoom Workplace for Windows, CVE-2026-53412, with a CVSS score of 9.8. That flaw could enable an unauthenticated user to take control of accounts.

Patching Advice

Although Zoom makes no mention of the vulnerabilities being exploited in the wild, users are advised to apply the latest patches to mitigate potential threats.

Sources: The Hacker News