Zoom Workplace for Windows CVE-2026-108186: update to 7.1.8

TL;DR: Zoom published two Workplace for Windows bulletins on November 10, 2026. ZSB-26023 covers CVE-2026-108186, an improper input validation issue that Zoom rates CVSS 3.1 9.6 (Critical), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Zoom says it may allow an unauthenticated user to conduct an escalation of privilege via network access, and lists Zoom Workplace for Windows starting on version 7.1.0 and before version 7.1.8. ZSB-26024 covers CVE-2026-108187, an origin validation error that Zoom rates CVSS 3.1 8.1 (High), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. It uses the same privilege-escalation wording and lists Zoom Workplace for Windows before version 7.1.5. Both bulletins tell users to apply the latest updates at zoom.us/download. Version 7.1.8 is the first release outside the ZSB-26023 range, and it is also later than 7.1.5, so it sits outside both ranges. Zoom lists only the Windows app in these bulletins. Zoom has not reported exploitation, and neither CVE is in CISA’s KEV catalog as of 1:13 p.m. Manila (UTC+8).

What happened

On November 10, 2026, Zoom published revision 1.0 of two security bulletins for Zoom Workplace for Windows, both marked “Initial publication.”

ZSB-26023 is titled “Zoom Workplace for Windows - Improper Input Validation.” It assigns CVE-2026-108186, rates the issue Critical with a CVSS score of 9.6, and gives the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. The description is: “Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.” The affected product line is “Zoom Workplace for Windows starting on version 7.1.0 and before version 7.1.8.” Zoom credits the report to Zoom Offensive Security.

ZSB-26024 is titled “Zoom Workplace for Windows - Origin Validation Error.” It assigns CVE-2026-108187, rates the issue High with a CVSS score of 8.1, and gives the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. The description is: “Origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.” The affected product line is “Zoom Workplace for Windows before version 7.1.5.” Zoom credits the report to shmoul.

Neither bulletin describes the user action that would trigger the issue, and neither mentions a proof of concept. We do not add any of that. Both say: “Users can help keep themselves secure by applying the latest updates available at https://zoom.us/download.”

Zoom has not reported exploitation in either bulletin, and neither CVE-2026-108186 nor CVE-2026-108187 is in CISA’s Known Exploited Vulnerabilities catalog as of 1:13 p.m. Manila (UTC+8).

Am I affected?

Zoom lists only Zoom Workplace for Windows in these two bulletins. They do not list macOS, Linux, mobile clients, Zoom Rooms, or other Zoom products, and we do not extend the range.

Check the version you are running. Zoom’s support article Checking the Zoom version number gives this path: profile picture > Help > About Zoom Workplace (not just “About”).

• If the version is starting on 7.1.0 and before 7.1.8, it is in the range ZSB-26023 lists for CVE-2026-108186.
• If the version is before 7.1.5, it is also in the range ZSB-26024 lists for CVE-2026-108187.
• Version 7.1.8 is outside the ZSB-26023 range. Because 7.1.8 is later than 7.1.5, it is also outside the ZSB-26024 range. ZSB-26024 itself does not name 7.1.8; it tells users to apply the latest updates and lists versions before 7.1.5 as affected.

How to update

1. In the app, use profile picture > Check for Updates. Zoom’s support article Updating Zoom to the latest version places that command on the profile menu, not under Help. If a newer version is available, Zoom will download and install it.
2. If Check for Updates is missing, the manual route is zoom.us/download. The same support article says that if the desktop app was installed with the MSI installer, AutoUpdate is disabled by default and the Check for Updates button is also removed. Contact your IT team or Zoom account admin for help with updating. Both bulletins also send users to https://zoom.us/download.

Neither bulletin lists a workaround. If you cannot update immediately, those bulletins still do not offer an alternative to applying the latest updates.

Other alerts are on our security coverage hub.

Why it matters

Both CVSS vectors are network-reachable (AV:N) and require no privileges (PR:N), and both require user interaction (UI:R). Zoom has not said what that interaction is. Scope changed (S:C) and an availability impact of High (A:H) apply only to CVE-2026-108186. CVE-2026-108187 is scored with unchanged scope (S:U) and no availability impact (A:N). We stick to those vectors and do not infer an exploit path Zoom has not described.

These issues are in a desktop app many people leave running. Check the version, and if you are in either bulletin’s range, apply the latest updates.

Updates

• Nov 12, 2026, 1:15 p.m. Manila (UTC+8): Initial report covering Zoom’s November 10, 2026, revision 1.0 bulletins ZSB-26023 (CVE-2026-108186) and ZSB-26024 (CVE-2026-108187), the 7.1.8 and before-7.1.5 version ranges, and a KEV check that found neither CVE listed.
• Nov 12, 2026, 1:20 p.m. Manila (UTC+8): Menu-path wording aligned to Zoom support (profile picture > Help > About Zoom Workplace; profile picture > Check for Updates, on the profile menu, not under Help; MSI installs hide Check for Updates, so the manual route is zoom.us/download). Scope changed (S:C) stated as applying only to CVE-2026-108186; CVE-2026-108187 remains S:U, A:N.

Sources & method

• Zoom, ZSB-26023: Zoom Workplace for Windows - Improper Input Validation (revision 1.0, 11/10/2026) — https://www.zoom.com/en/trust/security-bulletin/zsb-26023
• Zoom, ZSB-26024: Zoom Workplace for Windows - Origin Validation Error (revision 1.0, 11/10/2026) — https://www.zoom.com/en/trust/security-bulletin/zsb-26024
• Zoom, download page cited in both bulletins — https://zoom.us/download
• Zoom support, Checking the Zoom version number — https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0063656
• Zoom support, Updating Zoom to the latest version — https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0060716
• CISA Known Exploited Vulnerabilities catalog — https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

Last checked: Nov 12, 2026, 1:13 p.m. Manila (UTC+8). Method: We read Zoom’s ZSB-26023 and ZSB-26024 bulletins, and the CISA KEV JSON feed, at 1:13 p.m. Manila (UTC+8). We did not re-fetch those pages or the KEV feed for this wording revision. The feed was catalog version 2026.11.10, dateReleased 2026-11-10T19:03:29.8375Z, and contained no entry for CVE-2026-108186 or CVE-2026-108187. Zoom has not reported exploitation in either bulletin. We used Zoom’s CVSS scores and version ranges, and we did not treat 7.1.5 as the fix for CVE-2026-108186. Menu paths are from Zoom support KB0063656 (profile picture > Help > About Zoom Workplace) and KB0060716 (profile picture > Check for Updates, on the profile menu, not under Help; MSI installs hide that button, so the manual route is https://zoom.us/download), read the same afternoon. Thumbnail is a reuse-licensed image, credited with its license under the picture. No affiliate links. How we work.