Zoom published two security bulletins on November 10 for Zoom Workplace for Windows. The more serious, CVE-2026-108186 (ZSB-26023), is an improper input validation flaw rated Critical at 9.6 out of 10 that, per Zoom, “may allow an unauthenticated user to conduct an escalation of privilege via network access.” The second, CVE-2026-108187 (ZSB-26024), is an origin validation error rated High at 8.1 with the same description. Zoom credits its own Offensive Security team with the first and a researcher using the handle “shmoul” with the second.
Zoom’s bulletins do not say either flaw is being exploited, and The Hacker News likewise notes that Zoom makes no mention of exploitation in the wild. The bulletins also give no technical detail on how the flaws work. The CVSS vectors Zoom published describe both as reachable over the network with no privileges required, but marked as needing user interaction (UI:R); The Hacker News’s summary does not mention that requirement. The two flaws cover different version ranges, so which one applies depends on the version you run.
How to check if you’re affected
Affected products are Zoom Workplace for Windows installs in these version ranges, per Zoom’s bulletins:
- CVE-2026-108186 (critical): versions starting at 7.1.0 and before 7.1.8.
- CVE-2026-108187 (high): versions before 7.1.5.
Version 7.1.8 or later falls outside both ranges. Zoom’s advice in both bulletins is to apply the latest update from zoom.us/download. The bulletins list only Zoom Workplace for Windows; they do not mention other Zoom apps or platforms, so this post does not claim anything about them. If you manage a fleet of Windows devices, compare the installed Zoom Workplace version on each one against the ranges above.