Zoom has released fixes for two security flaws in Zoom Workplace for Windows, including a critical vulnerability rated 9.6 out of 10 that could let an attacker with no account escalate their privileges over a network. Windows users should update to version 7.1.8, which fixes both flaws.

Zoom published the two security bulletins, ZSB-26023 and ZSB-26024, on 10 November 2026. The more serious of the two flaws is tracked as CVE-2026-108186. Zoom describes it as an improper input validation vulnerability, meaning the application did not check some incoming data carefully enough. An unauthenticated user could use it to conduct an escalation of privilege via network access, according to the bulletin.

What CVE-2026-108186 affects

CVE-2026-108186 affects Zoom Workplace for Windows from version 7.1.0 up to, but not including, version 7.1.8. It carries a CVSS score of 9.6, which puts it in the critical range. The scoring vector shows the flaw is reachable over a network, needs low attack complexity and no prior privileges, but does require some user interaction, and its impact can cross a security boundary.

The second flaw, CVE-2026-108187, is an origin validation error rated 8.1, in the high range. Zoom says it could also allow an unauthenticated user to conduct an escalation of privilege via network access. It affects Zoom Workplace for Windows before version 7.1.5. Version 7.1.8 covers both flaws, so a single update to the latest release addresses them together.

No exploitation reported so far

Zoom has not said that either vulnerability is being exploited in the wild, and neither flaw appears in the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue. That is reassuring, but it is not a reason to delay: the flaws are now public, the fixes are available, and privilege-escalation bugs in widely used workplace software are routinely picked up by attackers once details circulate.

Successful exploitation could let a remote attacker raise their access level on an affected Windows machine without needing any special permissions or prior access. On a work laptop that could mean moving from an ordinary user account to far broader control of the system, depending on how the application is configured.

What users and IT teams should do

Update Zoom Workplace for Windows to version 7.1.8 or later. Individuals can check for updates inside the application or download the latest version from Zoom. IT administrators should check which versions are running across their estate, prioritise machines still on versions 7.1.0 to 7.1.7, and confirm the update has actually been applied rather than assuming an automatic update completed.

Organisations that manage Zoom centrally should also review whether any users are running older builds that fall outside the supported update path, and make sure remote and hybrid workers are included in the rollout rather than only office machines.

A repeat of a July problem

This is not the first time Zoom has had to fix this kind of flaw in its Windows client. In July 2026 the company shipped fixes for another improper input validation flaw, CVE-2026-53412, rated 9.8, which could have let an unauthenticated user take control of accounts. The recurrence underlines why keeping the desktop client updated matters: the same class of weakness has now appeared twice in the same product in a few months.

For most users the fix is a routine update. The risk comes from leaving it undone, so the practical advice is simple: update Zoom on Windows now, and check that colleagues and family members on the same software have done the same.

Sources: The Hacker News and SecurityOnline.