Short answer: Zoom released updates to fix two critical flaws that could allow unauthenticated users to escalate privileges. Users should update Zoom Workplace for Windows to the latest version.
TL;DR
- Zoom fixed critical flaws in Workplace for Windows.
- Vulnerabilities could let unauthenticated users escalate privileges.
- CVE-2026-108186 has a CVSS score of 9.6.
- CVE-2026-108187 has a CVSS score of 8.1.
What is CVE-2026-108186?
Zoom Workplace for Windows had two critical vulnerabilities that could let unauthorized users gain higher access levels. These flaws, CVE-2026-108186 and CVE-2026-108187, could enable remote attackers to escalate privileges without needing special permissions. Zoom released updates to fix these issues, and users are advised to update their software to the latest version to stay secure.
- Vulnerability
- A mistake or weakness in software that an attacker can misuse.
- CVE
- A public ID number (like CVE-2026-12345) given to a known security weakness so everyone can talk about the same bug.
- Exploit
- Code or steps that take advantage of a weakness.
Key facts
| Reported by | The Hacker News |
|---|---|
| Date reported | 11 Nov 2026 |
| CVE | CVE-2026-108186 |
| CVSS | 9.6 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| Weakness | CWE-20 (improper input validation) |
| CISA KEV | Not listed (no confirmed exploitation in KEV) |
| CVE | CVE-2026-108187 |
| CVSS | 8.1 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| Weakness | CWE-346 (see NVD) |
| CISA KEV | Not listed (no confirmed exploitation in KEV) |
| CVE | CVE-2026-53412 |
| CVSS | 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Weakness | CWE-20 (improper input validation) |
| CISA KEV | Not listed (no confirmed exploitation in KEV) |
| Vendor advisory | www.zoom.com |
| Affected product | Zoom Workplace |
| Published in NVD | 2026-11-10 (CVE-2026-108186) |
| Published in NVD | 2026-11-10 (CVE-2026-108187) |
| Published in NVD | 2026-07-16 (CVE-2026-53412) |
How it works
Zoom Workplace for Windows has a flaw where an unauthenticated user can exploit an input validation issue (CVE-2026-108186) to gain higher privileges. Another flaw (CVE-2026-108187) lets attackers escalate privileges via network access. These issues can let attackers take control without needing special permissions.
- Attacker reaches the Zoom Workplace over the internet / network
- No login or account is needed
- A user must open a link or file first
- Sends crafted input that triggers the improper input validation flaw
- Impact: data can be read, data or code can be changed, service crashes or stops
Skillmate analyst mapping (our judgement, not from the vendor):
- T1190 Exploit Public-Facing Application
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-07-16 | CVE-2026-53412 published in NVD | NVD |
| 2026-11-10 | CVE-2026-108186 published in NVD | NVD |
| 2026-11-10 | CVE-2026-108187 published in NVD | NVD |
| 2026-11-11 | Reported by The Hacker News | The Hacker News |
| 2026-11-11 | This Skillmate explainer published | Skillmate |
Am I affected?
These commands only read the version or settings. Compare the output with the vendor advisory linked in the facts table.
Microsoft Windows
PowerShell: lists the latest installed updates:
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10shows the Windows version and build:
winverHow to fix it
- Update Zoom Workplace to the fixed release named in the vendor advisory.
- Read the vendor advisory for CVE-2026-53412 and upgrade to the fixed release it lists.
- If you cannot patch today, limit who can reach the affected service and watch its logs.
How to detect it
Defenders should look for unexpected network activity or privilege changes.
What is confirmed and what is not
| Confirmed | Not confirmed yet |
|---|---|
| CVE-2026-108186 is a real NVD record scored 9.6 CRITICAL | CISA KEV does not list CVE-2026-108186 as exploited in the wild |
| CVE-2026-108187 is a real NVD record scored 8.1 HIGH | NVD links no vendor advisory for CVE-2026-108186 yet |
| CVE-2026-53412 is a real NVD record scored 9.8 CRITICAL | CISA KEV does not list CVE-2026-108187 as exploited in the wild |
| Reported by The Hacker News | NVD links no vendor advisory for CVE-2026-108187 yet |
| Reported by www.zoom.com |
Why it matters
These vulnerabilities can allow attackers to take control of systems without permission. Companies and users must apply updates to protect against potential threats.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What are the vulnerabilities affecting Zoom Workplace?
Zoom Workplace has two critical flaws (CVE-2026-108186) and one high-risk flaw (CVE-2026-108187) that could let attackers gain unauthorized access.
How can I protect my system?
Apply the latest updates available at to mitigate these risks.
What versions of Zoom Workplace are affected?
CVE-2026-108186 impacts versions from 7.1.0 to 7.1.8, while CVE-2026-108187 affects versions before 7.1.5.
Are these vulnerabilities being exploited in the wild?
Zoom does not mention that these vulnerabilities have been exploited in the wild, but users should still apply the patches.
Related Skillmate posts
Sources
- Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation (The Hacker News)
- Primary source / advisory (www.zoom.com)
- Primary source / advisory (www.zoom.com)
- Vendor advisory CVE-2026-53412 (www.zoom.com)
- NVD CVE record (NVD)
How we wrote this: facts come from the sources above, NVD and CISA KEV. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.