Zoom fixes a 9.6 critical privilege flaw in its Windows app

Zoom fixes a 9.6 critical privilege flaw in its Windows app

10 November 2026: Zoom has rated a flaw in Zoom Workplace for Windows critical, 9.6 on the CVSS 3.1 scale, because it may let an unauthenticated user escalate privileges over the network; versions from 7.1.0 up to, but not including, 7.1.8 are affected. A second bulletin published alongside it covers a high-rated flaw in the same app.

Not yet independently verified. Both bulletins rest on Zoom's own pages, which give no exploitation status and no technical detail beyond the one-line description; we found no independent analysis yet. We will update this when it can be confirmed, and remove this note.

What ZSB-26023 says

The bulletin, tracked as CVE-2026-108186, describes the bug in one line as improper input validation in Zoom Workplace for Windows that "may allow an unauthenticated user to conduct an escalation of privilege via network access." Its vector string, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, adds two details the summary leaves out. The attack needs some action from the user, so it is not a silent remote takeover, and the scope is changed, meaning a successful attack reaches beyond the Zoom app itself. Confidentiality, integrity and availability are all rated high.

Zoom credits its own Offensive Security team with the find. The bulletin covers only the Windows desktop app; Zoom names no other platform as affected.

The second bulletin, ZSB-26024

CVE-2026-108187 is an origin validation error in Zoom Workplace for Windows, again described as letting an unauthenticated user escalate privileges over the network. Zoom scores it 8.1, high. Its affected range is wider and older: every version before 7.1.5. A machine already on 7.1.5 to 7.1.7 is clear of this one but still exposed to ZSB-26023, so the target for both is 7.1.8 or later.

Getting fleets to 7.1.8

Zoom's desktop client updates itself when users accept the prompt, but many organisations turn that off and push builds through their own software distribution, which is where a client can sit for months. Administrators deploying through Intune, Configuration Manager or a similar tool need the 7.1.8 MSI in the package library and the old one retired. Zoom's admin settings can also force a minimum client version so that out-of-date installs are prompted, or blocked, when they join a meeting. Neither bulletin offers a workaround short of updating, and neither says whether either flaw has been used in an attack.

Zoom Video Communications has a company profile in our catalogue, which lists nine video conferencing products.

Related on TrustList:

• Zoom fixes three high-severity flaws in Workplace and Rooms apps

Sources

• Zoom Security Bulletin ZSB-26023: Zoom Workplace for Windows, Improper Input Validation, 10 November 2026
• Zoom Security Bulletin ZSB-26024: Zoom Workplace for Windows, Origin Validation Error, 10 November 2026