Zoom patches CVE-2026-108186 and CVE-2026-108187 in Zoom Workplace for Windows

On Nov. 11, 2026, Zoom issued updates for two security flaws in Zoom Workplace for Windows. One is CVE-2026-108186, an improper input validation vulnerability rated 9.6 that lets an unauthenticated user escalate privileges over the network, affecting releases from 7.1.0 up to but not including 7.1.8. The second flaw, CVE-2026-108187, is an origin validation vulnerability rated 8.1 affecting releases earlier than 7.1.5, and it also lets an unauthenticated user escalate privileges over the network. Zoom’s advisory does not state that either November flaw is under active exploitation in the wild, and Zoom recommends applying the latest patches to lower potential threat exposure.

Remote attackers can raise privileges by exploiting either shortcoming, with no special permissions or access required. Reportedly, the platform serves over 300 million daily active users and 470,000 paying business customers, making flaws in its Windows client a concern for business customers. France tried banning Zoom use by French government users in July 2026.

Frank Dickson, group VP for security at IDC, said attackers can exploit the flaw over the network with low complexity, zero privileges required, and no user interaction. “It is exploitable over the network, low complexity, zero privileges required, no user interaction needed,” Dickson said. He added that attackers can exploit the flaw more easily after technical details leak or the patch is reverse-engineered, a task AI makes simpler, and that no outlet had reported in-the-wild exploitation as of Thursday. Romanus Prabhu Raymond, director of Technology at ManageEngine, said, “Vulnerability notices create a race between an organization’s endpoint strategy and hackers for control of these attractive high-value targets.”

Brian Levine, executive director of FormerGov, said an attacker with full account access could listen to meeting recordings, eavesdrop on future meetings, and impersonate the organization to social engineer clients and partners. Giuseppe Trotta, principal security researcher at Malwarebytes, theorized that mishandling of deep links such as zoommtg:// or zoomworkplace:// likely drives the remote network attack. Justin Greis, CEO of Acceligence, said the critical vulnerability deserves the most attention as an initial entry point, while privilege escalation holes increase the impact of an attack already under way.

Zoom shipped fixes in July 2026 for CVE-2026-53412, an improper input validation flaw in Zoom Workplace for Windows rated 9.8 on CVSS, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The flaw was reported by Zoom Offensive Security and could let an unauthenticated user seize control of an account over the network. Zoom Workplace for Windows releases earlier than 7.0.0 were affected, as were Zoom VDI Client for Windows releases before 7.0.10, 6.6.15, and 6.5.18 in their respective branches. When the July flaws were disclosed, there were no indications any fixed vulnerabilities were being exploited in attacks.

CVE-2026-53410, a high-severity TOCTOU race condition letting authenticated local users escalate privileges during installation or uninstallation, was also addressed. CVE-2026-53409, a high-severity improper privilege management flaw in Zoom Rooms for Windows before version 7.1.0, lets authenticated local users escalate privileges and was addressed. CVE-2026-53411, a high-severity improper input validation flaw in Zoom Workplace VDI Plugin for Windows before version 6.6.14, was addressed; it allows authenticated local users to escalate privileges. The advisory first listed Zoom Meeting SDK for Windows before version 7.0.0 as affected, then removed it without explanation.