---
title: Zoom fixes a critical 9.6 privilege escalation in Zoom Workplace for Windows; update to 7.1.8 | ctxsec
url: https://ctxsec.com/items/zoom-workplace-windows-cve-2026-108186-critical-9-6-cve-2026-108187-update-7-1-8
description: "Zoom published two bulletins for Zoom Workplace for Windows. CVE-2026-108186 (ZSB-26023, critical, CVSS 9.6) is an improper input validation flaw that may let an unauthenticated user escalate privileges via network access, affecting versions 7.1.0 up to 7.1.8. CVE-2026-108187 (ZSB-26024, high) is an origin validation error with a similar unauthenticated escalation impact. Version 7.1.8 or later fixes both."
status: "official (Zoom security bulletins ZSB-26023 and ZSB-26024, Nov 10, 2026); Zoom does not report exploitation"
published: 2026-11-11
---

> Zoom published two bulletins for Zoom Workplace for Windows. CVE-2026-108186 (ZSB-26023, critical, CVSS 9.6) is an improper input validation flaw that may let an unauthenticated user escalate privileges via network access, affecting versions 7.1.0 up to 7.1.8. CVE-2026-108187 (ZSB-26024, high) is an origin validation error with a similar unauthenticated escalation impact. Version 7.1.8 or later fixes both.

[← Cybersecurity News](/news) · [markdown](/items/zoom-workplace-windows-cve-2026-108186-critical-9-6-cve-2026-108187-update-7-1-8.md)

official (Zoom security bulletins ZSB-26023 and ZSB-26024, Nov 10, 2026); Zoom does not report exploitation

2026-11-11 11:37 AM ET

### Zoom fixes a critical 9.6 privilege escalation in Zoom Workplace for Windows; update to 7.1.8

- **Do now:** push Zoom Workplace for Windows 7.1.8 or later through your software deployment tool and check for machines stuck on older builds.
- **Severity detail:** the CVSS vector for CVE-2026-108186 (AV:N/AC:L/PR:N/UI:R/S:C) needs user interaction and has a changed scope, so impact can reach beyond the Zoom app. Zoom Offensive Security found it internally.
- Zoom gives no further technical detail and does not report exploitation; neither CVE is in CISA KEV.

Sources: [Zoom ZSB-26023: Zoom Workplace for Windows - Improper Input Validation (CVE-2026-108186)](https://www.zoom.com/en/trust/security-bulletin/zsb-26023/) · [Zoom Security Bulletins (ZSB-26023 and ZSB-26024, Nov 10, 2026)](https://www.zoom.com/en/trust/security-bulletin/)