Zoom Workplace for Windows: Update to 7.1.8 to Close a 9.6 Privilege-Escalation Flaw and Its 8.1 Companion
Zoom has fixed two privilege-escalation flaws in Zoom Workplace for Windows, one of them rated critical. CVE-2026-108186 scores 9.6 and affects versions 7.1.0 up to but not including 7.1.8; CVE-2026-108187 scores 8.1 and affects everything before 7.1.5. The overlap catches anyone who updated part of the way: machines on 7.1.5, 7.1.6 or 7.1.7 are safe from the second flaw but still exposed to the more serious first one.
| CVE-2026-108186 | 9.6 · improper input validation · 7.1.0 to before 7.1.8 |
| CVE-2026-108187 | 8.1 · origin validation error · before 7.1.5 |
| Needs | User interaction (UI:R), no privileges |
| Réparer | 7.1.8 or later covers both |
Ce qui s'est passé
[Confirmed] Zoom’s bulletin ZSB-26023 rates CVE-2026-108186 Critical (CVSS 9.6, vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H): improper input validation in Zoom Workplace for Windows that “may allow an unauthenticated user to conduct an escalation of privilege via network access”. It affects 7.1.0 up to, but not including, 7.1.8, and was found by Zoom Offensive Security. ZSB-26024 covers CVE-2026-108187 (8.1, origin validation error) in versions before 7.1.5, reported by “shmoul”. Both were published on 10 November. (Zoom ZSB-26023) (ZSB-26024)
Who is affected and how it works
[Confirmed] Windows installs of Zoom Workplace in those ranges. [Reported] Neither Zoom nor the press reports exploitation, and 7.1.8 fixes both. (Les actualités des hackers) (Semaine de la sécurité) [Unknown] The exact attack scenario. Both vectors need a user action, such as joining a meeting or clicking a link; we won’t guess which. Whether macOS, Linux, VDI or Rooms builds share either flaw isn’t stated in what we read.
What to look for, then fix
- Find the version across the fleet with your software inventory or MDM; anything from 7.1.0 to 7.1.7 has the 9.6 flaw, and anything before 7.1.5 has both.
- Push 7.1.8 or later and turn on Zoom’s auto-update where users install it themselves.
- [MAG212 analysis] No indicators exist. Until patched, watch for Zoom processes spawning shells or writing to system folders.
Vérifier la récupération : the inventory shows no Windows build below 7.1.8. Prevention [MAG212 analysis]: user-installed per-user Zoom copies often escape central patching; block them or bring them under management.
Rolling it out without breaking meetings
Zoom Workplace updates are small and usually install in the background, but managed fleets often pin a version for stability or deploy through a packaging tool on a monthly cycle. That cadence is the problem: a machine pinned at 7.1.5 looks recently updated in reports while still carrying the 9.6 flaw. Check the actual build number, not the date of the last update.
[MAG212 analysis] A sensible order is: IT and executive laptops first, because they join the most external meetings; then shared meeting-room PCs and kiosks, which are often forgotten; then the rest of the fleet. Where users can install Zoom themselves, per-user copies under the profile folder escape machine-wide deployment tools, so either block per-user installs or let Zoom’s own auto-update handle them.
[MAG212 analysis] Schools and small businesses without device management can still close this quickly: ask users to open Zoom, choose Check for Updates from the profile menu and confirm the version afterwards.
Pourquoi c'est important
Zoom runs on almost every corporate and school laptop, often installed per user and outside central patching. A network-reachable escalation flaw in a client that joins meetings with outsiders is attractive, even if both bugs need a user to do something first. Nobody reports exploitation yet, which is the window to patch calmly.
The bottom line
Use your inventory or MDM to find every Windows install below 7.1.8, push the update, and bring self-installed per-user copies under management so the next Zoom fix reaches them too.
How we label evidence: [Confirmed] comes from a primary source such as a vendor or CISA; [Reported] from a secondary outlet; [Claimed] from an attacker or an unverified party; [MAG212 analysis] is our judgement; [Unknown] means not established at press time. Commands and indicators are copied from the cited sources and were not tested by MAG212 CYBER.
This story is part of MAG212 CYBER Daily, 12 November 2026, with the day’s other verified stories, the Defender’s Action Desk and a full source register. Get the daily briefing free: subscribe to MAG212 CYBER. Par El Mostafa Ouchen.