On this page
Short answer: On November 10, 2026, Zoom published security bulletin ZSB-26023, a critical flaw (CVE-2026-108186, CVSS 9.6) in Zoom Workplace for Windows versions 7.1.0 up to, but not including, 7.1.8. A second bug affects earlier builds. Admins should update every Windows client to 7.1.8 or later.
Key facts
| Item | Detail |
|---|---|
| Product | Zoom Workplace for Windows |
| Published | November 10, 2026 (Zoom bulletins, revision 1.0) |
| Critical flaw | CVE-2026-108186, improper input validation, CVSS 9.6, affects 7.1.0 up to before 7.1.8 |
| Second flaw | CVE-2026-108187, origin validation error, CVSS 8.1, affects versions before 7.1.5 |
| Status | Patched; Zoom's bulletins do not mention exploitation |
| Primary source | Zoom ZSB-26023 and ZSB-26024 |
What happened
Zoom's bulletin says improper input validation in Zoom Workplace for Windows "may let an unauthenticated user escalate privileges via network access" (ZSB-26023). The bulletin rates it Critical at CVSS 9.6 and credits Zoom Offensive Security with the report.
The same day Zoom published ZSB-26024 for CVE-2026-108187, an origin validation error in the same Windows client that carries the same unauthenticated privilege-escalation wording. It is rated High at CVSS 8.1 and credits a researcher named shmoul.
Neither bulletin mentions exploitation in the wild, and neither names a fixed build. Both tell users to apply the latest updates from zoom.us/download. The Hacker News reported the same two flaws on November 11 and also says Zoom does not mention exploitation.
The CVSS vector in each bulletin includes user interaction required (UI:R). "Unauthenticated" here means the attacker needs no account, not that the flaw triggers with no action from a user.
Who is affected
Any Windows computer running Zoom Workplace in one of the version ranges below. Zoom's bulletins list only the Windows client.
| Zoom Workplace for Windows version | CVE-2026-108186 (Critical, 9.6) | CVE-2026-108187 (High, 8.1) |
|---|---|---|
| Before 7.1.0 | Not listed as affected | Affected |
| 7.1.0 to 7.1.4 | Affected | Affected |
| 7.1.5 to 7.1.7 | Affected | Not listed as affected |
| 7.1.8 or later | Not listed as affected | Not listed as affected |
Table derived from the affected ranges in Zoom's ZSB-26023 and ZSB-26024.
What to do now
- Find the installed Zoom Workplace version on every Windows endpoint using your RMM, endpoint management or software inventory tool.
- Update any client below 7.1.8 to the latest version from zoom.us/download, as Zoom's bulletins advise.
- Check that auto-update or your software deployment tool is not pinning an older build, so the fix is not reverted.
- Treat machines you cannot update promptly, such as kiosks or shared meeting-room PCs, as the highest exposure and schedule them first.
- Watch the Zoom security bulletin page for revisions to either bulletin.
What we do not know yet
- Zoom does not say whether either flaw is exploited, and its bulletins give no technical detail on the attack path.
- Zoom does not name the exact fixed build for CVE-2026-108187. The affected range ends before 7.1.5, so any build at 7.1.8 or later is outside both ranges.
What this means for buyers
Desktop meeting clients run on every employee's machine, so their patch process is part of the cost of a unified communications platform. When you compare vendors, ask how each one publishes fixed builds and whether admins can force updates centrally. Our Unified Communications hub lists the platforms we cover, and the shortlist tool lets you record your deployment requirements.
Bottom line
Update every Zoom Workplace for Windows client to 7.1.8 or later, starting with machines that are hardest to reach. If Zoom revises either bulletin to report exploitation or adds affected platforms, this guidance will change.