Zoom announced on November 10 an update that closes two security vulnerabilities in its desktop app for Windows. One of them is rated critical: CVE-2026-108186 in Zoom Workplace for Windows received a score of 9.6. According to Zoom’s bulletin ZSB-26023, the issue is improper input validation and could allow an unauthenticated user to escalate privileges over the network.
The second vulnerability, CVE-2026-108187, is rated high with a score of 8.1. This time it is classified as an improper source validation issue, but the result is the same: an unauthenticated person with network access can escalate privileges. Zoom disclosed this issue in bulletin ZSB-26024.
Affected versions
The 9.6-rated vulnerability affects Windows installations starting with version 7.1.0 up to, but not including, 7.1.8. The 8.1-rated vulnerability exists in all Windows versions before 7.1.5. In other words, those using 7.1.5, 7.1.6, and 7.1.7 are exposed only to the critical issue, while those still on older versions are exposed to both vulnerabilities.
Risk level of the vulnerabilities
Both vulnerabilities have CVSS vectors that indicate network access (AV:N) and no privileges required (PR:N); the attacker does not need to log in. On the other hand, user interaction (UI:R) is required, meaning the victim has to trigger some action. The critical vulnerability also has the scope changed (S:C) flag: the impact may extend beyond the application boundary to the operating system side. Zoom says the 9.6 issue was found by its own security team, while the 8.1 issue was reported by an external researcher (shmoul).
Neither CVE appears on CISA’s Known Exploited Vulnerabilities (KEV) list, and the bulletins do not mention active exploitation either. That means there is no evidence the vulnerabilities are being used in the wild; it is not a reason to delay patching.
How to update
To see the version in the desktop app, open the profile menu in the top right, then follow Help and then About Zoom. If you see a version older than 7.1.8, download and install the latest one from zoom.us/download. On machines with automatic updates enabled, the new version will usually arrive on its own. In a corporate environment, if the version is pinned via an MSI package, an upgrade to 7.1.8 should be planned; devices still on versions earlier than 7.1.5 carry both vulnerabilities.
The bulletins cover only the Windows client. There is no security advisory published the same day for Zoom’s macOS, Linux, iOS, or Android versions.
Source: Zoom ZSB-26023 · ZSB-26024 · NVD
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.