Zoom’s Windows app has a critical bug an outsider can trigger. Get every PC to 7.1.8

Zoom patched two privilege escalation bugs in Zoom Workplace for Windows on Tuesday. One is rated critical at 9.6 and can be triggered by an attacker with no account, over the network.

Zoom sits on nearly every company laptop, and plenty of those copies never update because nobody restarts the app. The fix is version 7.1.8.

Zoom’s Windows app has a 9.6 bug an outsider can trigger over the network. Version 7.1.8 fixes it. Check what your fleet is actually running.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Zoom fixes a critical bug in its Windows app

CVE-2026-108186 is an improper input validation bug in Zoom Workplace for Windows. Zoom’s bulletin ZSB-26023 says it “may allow an unauthenticated user to conduct an escalation of privilege via network access.” It affects versions 7.1.0 up to 7.1.8 and was found by Zoom’s own offensive security team.

CVE-2026-108187 (ZSB-26024, CVSS 8.1) is an origin validation error, also unauthenticated and over the network, in versions before 7.1.5. Zoom has not published technical details for either, and SecurityWeek notes no mention of attacks.

Every Windows PC running Zoom Workplace below 7.1.8

Both CVSS vectors require the user to do something, such as click a link or join a meeting, so the attack likely starts with a message the user trusts. A 9.6 score with a changed scope means the impact can reach beyond the Zoom app itself.

Zoom installs per user by default on many PCs, outside the software center’s view. Those copies are the ones that fall behind.

Get Zoom to 7.1.8 and turn on auto-update

• Pull a software inventory for “Zoom Workplace” on Windows and flag anything below 7.1.8.
• Push the current MSI from Zoom’s download center through Intune, SCCM or your RMM.
• Turn on Zoom’s auto-update setting by policy so users stop deferring it.
• Remove per-user installs that your management tool can’t update and replace them with the managed machine-wide version.

Details

• CVE-2026-108186 (ZSB-26023): improper input validation, CVSS 9.6 (AV:N/PR:N/UI:R/S:C). Affected: Zoom Workplace for Windows 7.1.0 to before 7.1.8. Published November 10, 2026.
• CVE-2026-108187 (ZSB-26024): origin validation error, CVSS 8.1. Affected: Zoom Workplace for Windows before 7.1.5.
• Exploitation: none reported.

Hunt / verify

• Check for Zoom installs under user profile folders (AppData) that your patch tool doesn’t track.
• Look in EDR for Zoom processes spawning command shells or writing executables outside the Zoom folder.

Source: Zoom bulletin ZSB-26023; SecurityWeek report

Sources

• Zoom Security Bulletin ZSB-26023: Zoom Workplace for Windows, Improper Input Validation (CVE-2026-108186)
• Zoom Security Bulletin ZSB-26024: Zoom Workplace for Windows, Origin Validation Error (CVE-2026-108187)
• SecurityWeek: Asus, Zoom Release Security Patches

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].