Summary
- CVE-2026-108186 affects Zoom Workplace for Windows version 7.1 before 7.1.8 and carries a CVSS score of 9.6.
- The improper input validation vulnerability could permit privilege escalation under conditions including user interaction.
- Zoom also disclosed a separate high-severity origin validation weakness affecting its Windows client.
Organisations using Zoom Workplace on Windows face a critical software security risk after the collaboration platform provider disclosed a vulnerability that could allow privilege escalation through network-accessible functionality.
Zoom published bulletin ZSB-26023 on 10 November, identifying CVE-2026-108186 as an improper input validation vulnerability affecting Zoom Workplace for Windows.
The weakness carries a CVSS 3.1 score of 9.6, placing it in the critical severity category. The vendor-supplied vulnerability information identifies Zoom Workplace for Windows version 7.1 before 7.1.8 as affected.
The published assessment indicates that an unauthenticated attacker may exploit the flaw through a network attack vector, but user interaction is also required. The issue should not be described as an interaction-free compromise affecting every client installation.
Zoom separately disclosed CVE-2026-108187, a high-severity origin validation error affecting its Windows client, through bulletin ZSB-26024.
Neither advisory establishes that attackers are exploiting the vulnerabilities in the wild or identifies an incident attributed to either flaw.
Privilege escalation depends on the affected component
Improper input validation occurs when software does not adequately check information before processing it. The resulting security consequences depend on the affected code, the way the information is handled, and the privileges available to the application.
For CVE-2026-108186, Zoom identifies privilege escalation as a possible consequence, with substantial potential effects on confidentiality, integrity, and availability reflected in the severity assessment.
The public bulletin does not disclose a complete exploit sequence or demonstrate that an arbitrary remote attacker can compromise any affected device under all circumstances.
Separating the vulnerability’s potential impact from evidence of current exploitation allows organisations to prioritise updates without making unsupported claims about active attacks.
Collaboration software remains endpoint infrastructure
Video conferencing and workplace collaboration clients operate on devices used by employees, contractors, and advisers. These devices may also contain sensitive business documents, authentication sessions, and connections to other corporate applications.
Although Zoom provides cloud-based services, a locally installed Windows application still processes information and requires security maintenance. Securing hosted infrastructure does not remove an organisation’s responsibility for managing the software on its own devices.
Maintaining consistent client versions can be difficult across estates containing centralised laptops, contractor equipment, shared workstations, and remote users who connect infrequently to corporate management systems.
Application updates may also be deferred during busy periods or because of compatibility concerns. The result can be inconsistent exposure across an organisation even where its main operating systems are current.
Origin validation weakness is separate
Zoom’s second November advisory concerns an error in validating the origin of information supplied to the Windows application.
Origin checks help software determine whether a request or interaction comes from an expected source. Weaknesses in those checks can affect the trust assumptions made about incoming information.
However, the public advisory does not justify assuming the same prerequisites or consequences as the critical input validation flaw. Each vulnerability needs to be assessed independently against its affected versions and vendor guidance.
The simultaneous disclosures also demonstrate why remediation should cover all applicable corrections, rather than only the highest-scoring issue.
Client inventories determine the update scope
Zoom recommends updating to the latest available software version to receive security fixes and improvements.
Administrators should identify affected Windows clients, compare installed versions with the vendor’s security bulletins, and confirm that applicable updates have reached devices outside the office as well as centrally managed systems.
Where users can install collaboration applications independently, an operating system inventory alone may not establish whether outdated clients are present. Central management may require additional checks or application-specific reporting.
After updating, software version verification can establish whether remediation succeeded rather than relying solely on the presence of automatic update settings.
Zoom’s official security bulletin catalogue lists ZSB-26023 and ZSB-26024, published on 10 November.
Both disclosures concern locally installed collaboration software, making enterprise endpoint maintenance the immediate requirement while no corresponding active exploitation has been reported in the reviewed advisories.
