Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems.
The vulnerabilities are listed below –
- CVE-2026-108186 (CVSS score: 9.6) – An improper input validation vulnerability that could allow an unauthenticated user to conduct an escalation of privilege via network access.
- CVE-2026-108187 (CVSS score: 8.1) – An origin validation vulnerability that could allow an unauthenticated user to conduct an escalation of privilege via network access.
Successful exploitation of either of the shortcomings could permit remote attackers to escalate privileges without requiring any special permissions or access.
While CVE-2026-108187 affects Zoom Workplace for Windows before version 7.1.5, CVE-2026-108186 impacts versions starting from 7.1.0 and before 7.1.8.
Earlier this July, the popular videoconferencing platform shipped fixes for another improper input validation flaw impacting Zoom Workplace for Windows (CVE-2026-53412, CVSS score: 9.8) that could enable an unauthenticated user to take control of accounts.
Although Zoom makes no mention of the vulnerabilities being exploited in the wild, users are advised to apply the latest patches to mitigate potential threats.
