Zoom Workplace Critical Flaw Explained: 9.6-Rated CVE-2026-108186 and the 7.1.8 Update

Zoom Workplace critical flaw explained - Zoom app screenshot

Image: Wikimedia Commons / Zoom Video Communications (public domain) — the Zoom Workplace app interface.

TL;DR: The Zoom Workplace critical flaw explained in one line: Zoom patched a 9.6-rated bug (CVE-2026-108186) in its Windows app on 10 November 2026 that could let an attacker with no account escalate privileges over the network. A second flaw (CVE-2026-108187, rated 8.1) was fixed at the same time. Update Zoom Workplace for Windows to version 7.1.8 or later now — that single update closes both holes, and no attack has been confirmed yet.

Key Highlights

Zoom published two security bulletins on 10 November 2026 — ZSB-26023 and ZSB-26024 — covering Zoom Workplace for Windows only.
CVE-2026-108186 scores 9.6 (Critical): improper input validation that may let an unauthenticated user escalate privileges via network access.
CVE-2026-108187 scores 8.1 (High): an origin validation error with the same privilege-escalation outcome.
Version 7.1.8 fixes both flaws. If you are on 7.1.0 to 7.1.7, you are affected by the critical one; anything before 7.1.5 is affected by the second.
No exploitation has been reported, and neither flaw is in CISA's Known Exploited Vulnerabilities catalogue — but the fix is a one-minute update, so there is no reason to wait.

What happened?

On 10 November 2026, Zoom published two security bulletins for Zoom Workplace for Windows. The first, ZSB-26023, discloses CVE-2026-108186, a critical improper input validation flaw rated 9.6 out of 10. The second, ZSB-26024, discloses CVE-2026-108187, an origin validation error rated 8.1. Both bulletins carry the same warning in plain language: an unauthenticated user may be able to conduct an escalation of privilege via network access.

Zoom found the critical flaw through its own Offensive Security team; the second was reported by an external researcher credited as "shmoul". Neither bulletin describes the exact attack steps, and Zoom has not said the flaws have been exploited in the wild. SecurityWeek, reporting on the same day, confirmed Zoom makes no mention of any exploitation, and neither CVE appears in CISA's Known Exploited Vulnerabilities catalogue.

This is not Zoom's first input-validation scare this year. In July 2026, Zoom fixed another improper input validation flaw in the same Windows app, CVE-2026-53412, rated 9.8, and in August it patched the three "Zoomsday" annotation flaws. The pattern is worth noting: the Windows client keeps producing the same class of bug, and each time the fix has been the same — update the app.

Zoom Workplace critical flaw explained: the two CVEs

The two flaws look similar on paper but affect different version ranges, which is why the version number matters more than the CVE number for most readers.

Flaw	What it is	Severity	Affected versions	Fixed in
CVE-2026-108186 (ZSB-26023)	Improper input validation	9.6 Critical	Zoom Workplace for Windows 7.1.0 up to, but not including, 7.1.8	7.1.8
CVE-2026-108187 (ZSB-26024)	Origin validation error	8.1 High	Zoom Workplace for Windows before 7.1.5	7.1.5 (7.1.8 covers both)

In plain language: "improper input validation" means the app did not check some incoming network data carefully enough, so a crafted message could push it into granting more access than it should. An "origin validation error" means the app trusted a request without properly confirming where it came from. In both cases the attacker needs no Zoom account and no login — the bulletins say "unauthenticated user" — but there is one honest caveat. The CVSS vector for both flaws includes UI:R, meaning user interaction is required: the victim has to do something, such as join a meeting or click something, for the attack to work. Zoom has not disclosed what that action is, so nobody can yet say how easy the attack is in practice. That is a reason to update promptly, not a reason to panic.

Zoom Workplace critical flaw explained - a Zoom video meeting grid

Image: Wikimedia Commons (public domain) — a Zoom meeting in progress. The flaws affect the Windows desktop app, not the meeting itself.

What "privilege escalation" actually means for you

Privilege escalation sounds abstract, so here is the concrete version. Your Zoom app runs on your Windows PC with a certain level of system access. If an attacker exploits one of these flaws, they can raise their access level inside that machine — moving from whatever a normal network caller can do to something closer to what the app itself, or an administrator, can do. From there, the usual risks follow: reading files, changing settings, or using the machine as a foothold for something worse.

That is why the 9.6 score is high even though no attack has been seen: the ingredients are all there — reachable over the network, no login needed, and a severe impact if it works. The missing ingredient, for now, is a public exploit. No public exploit code has been reported, and Zoom has not reported any attacks. Updating before one appears is the whole point of a patch like this.

Why it matters for India readers

Zoom is the default meeting room for a huge share of Indian offices, startups, coaching classes and online classrooms, and the Windows desktop is the standard office machine. That combination is exactly what these bulletins target: the Windows app, versions most people installed months ago and have not checked since. Unlike a phone app that updates itself quietly, a Windows desktop app often sits on an old version until someone clicks "Check for Updates".

There is also a managed-PC wrinkle that matters in Indian workplaces. If your office laptop was installed with Zoom's MSI installer, automatic updates are disabled by default and the "Check for Updates" button is removed — Zoom's own support page says so. In that case only your IT team can push the update, so flagging it to them is the fix, not clicking around the app yourself. If you run a small business or a coaching centre with a handful of Windows machines, check each one: the version number is the whole diagnosis.

How to update Zoom on Windows

The fix takes about a minute, and version 7.1.8 closes both flaws at once.

Open Zoom Workplace on your Windows PC and sign in.
Click your profile picture in the top-right corner, then click Check for Updates.
If an update is available, let Zoom download and install it, then restart the app if prompted.
Check the version again — it should read 7.1.8 or higher. If it still shows an older number, close Zoom fully and run the installer again.
If there is no "Check for Updates" option at all, your copy was probably installed by IT with the MSI installer. Ask your IT team or admin to push 7.1.8, or download the latest version from Zoom's official download page at zoom.us/download and install it over your current copy.

Mac, iPhone and Android versions are not listed as affected in either bulletin — this is a Windows-only problem. Still, keeping every device on the latest version is good practice: Zoom has shipped several security fixes across its apps this year, and the update habit is what protects you from the next one.

Should you care?

✅ Yes — update today, but don't panic. A 9.6-rated, no-login flaw in an app that sits open on millions of work PCs deserves a one-minute update, not a worried afternoon. There is no confirmed exploitation and no public exploit code, so the risk right now is theoretical — but the fix is free, instant and removes the risk entirely. If you manage other people's machines, push 7.1.8 to the whole fleet before the weekend.

FAQs

Is Zoom Workplace safe to use after this flaw?
Yes, once you are on version 7.1.8 or later. The flaws affect older Windows versions only, and Zoom has patched both. If your app is up to date, you are not exposed to these two CVEs. The sensible habit is the same as ever: keep the app updated and do not join meetings from links you do not trust.

How do I update Zoom on Windows?
Sign in to the Zoom Workplace app, click your profile picture in the top-right corner, then click "Check for Updates" and install what it offers. If that option is missing, your copy was installed by IT — ask your admin to push version 7.1.8, or download the latest version from zoom.us/download and install it yourself.

What is CVE-2026-108186?
CVE-2026-108186 is a critical improper input validation flaw in Zoom Workplace for Windows, rated 9.6 out of 10. It affects versions 7.1.0 up to, but not including, 7.1.8, and may let an unauthenticated user escalate privileges over the network. Zoom disclosed it in bulletin ZSB-26023 on 10 November 2026, and version 7.1.8 fixes it.

Has the Zoom flaw been exploited in the wild?
No — Zoom has not reported any exploitation, no public exploit code has been reported, and neither CVE appears in CISA's Known Exploited Vulnerabilities catalogue. That is the position as of 11 November 2026; it can change, which is why updating now, before any exploit appears, is the right move.

Is the Zoom flaw a problem on Mac or mobile?
No. Both bulletins list only Zoom Workplace for Windows as affected. The Mac, iOS and Android apps are not named in ZSB-26023 or ZSB-26024, so Windows users are the ones who need to act.

Takeaway

Two flaws, one fix, one minute. Zoom's 10 November bulletins disclose a critical 9.6-rated bug in the Windows app that needs no login to attempt — and version 7.1.8 closes it completely. Open Zoom, check for updates, and confirm the number says 7.1.8 or higher.

Before your next call, open Zoom on your Windows PC and check the version — and if you work in an office, pass this to your IT team so the whole fleet gets 7.1.8. For the wider patch picture this week, read our guide to Microsoft's November Patch Tuesday, which fixed 1,094 flaws including an actively exploited Outlook zero-day.

TechByCountry — Daily Tech News, Country by Country

Search This Blog