Zoom published two security bulletins on November 10, 2026, saying improper input validation flaw CVE-2026-108186 in Zoom Workplace for Windows may let an unauthenticated user escalate privileges via network access, rated Critical with CVSS 9.6 [1][3]. A second origin validation error, CVE-2026-108187, also allows unauthenticated privilege escalation via network access and is rated High with CVSS 8.1; the first affects versions 7.1.0 up to before 7.1.8 and the second affects versions before 7.1.5 [1][2]. Organizations and individuals using Zoom Workplace for Windows should update to the latest version from Zoom’s download page now [1][2][3].
Two unauthenticated privilege-escalation flaws in Zoom Workplace for Windows, the worst rated CVSS 9.6; fixed versions available
1 min read
- Disclosed
- Nov 10, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- CVSS basis
- Our assessment
- 0.4%, higher than 36% of CVEs
- Exploitation and patch status
- Patch available
- Technology
- Attack vector
- Vulnerability status
- Actor type
On this page
30-second summary
What happened
Who is affected
Organisations running: Zoom Zoom Workplace for Windows
What to do nowOur advice
Affected scope
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
Technical details
Remediation
References
Official / primary2
- [1]Zoom2026-11-10Accessed 2026-11-11Snapshot 2026-11-11 sha256 bb052a4cd05d
“Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.”
- [2]Zoom2026-11-10Accessed 2026-11-11
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.