Zoom patches two network privilege-escalation flaws that need no authentication on Windows

November 11, 2026. Zoom ships two security fixes for Zoom Workplace on Windows. CVSS 9.6. That is the score of the more severe one, CVE-2026-108186, an input-validation flaw that lets an unauthenticated user escalate privileges over the network. Third time since July. It is the third time in four months that the same class of bug — input validation in the Windows client — has opened a privilege escalation or account takeover. Why it matters: both flaws fire without authentication and without user interaction, on an application installed by default across millions of corporate endpoints.

Two flaws, one network vector

The two vulnerabilities share the same entry point — network access — and the same consequence — privilege escalation — but differ in mechanism.

CVE-2026-108186, rated 9.6, is improper input validation. It affects Zoom Workplace for Windows from 7.1.0 up to, but not including, 7.1.8. An attacker who can reach the machine over the network exploits it to escalate, with no account and no prior rights.

CVE-2026-108187, rated 8.1, is an origin-validation flaw. It affects versions before 7.1.5. Here too the escalation is reached over the network, without authentication.

Both bulletins — ZSB-26023 for the first, ZSB-26024 for the second — state that successful exploitation lets a remote attacker escalate privileges “without requiring any special permissions or access.” Put operationally: a Windows machine running a vulnerable Zoom client offers an escalation primitive to anyone who can reach it on the network.

A recurrence that is no longer an accident

What lifts this batch out of the routine is the repetition. In July 2026, Zoom already patched CVE-2026-53412, an input-validation flaw rated CVSS 9.8 that let an unauthenticated user take over accounts. In August 2026, a zero-click flaw — nicknamed “Zoomsday” — closed a remote code-execution path, which we analyzed at the time.

The pattern is the same every time: a videoconferencing client, often running with elevated privileges to manage audio and video capture, processes network input with insufficient validation. Each patch closes one specific instance, but the surface — a rich native client that listens on the network and handles media streams — stays the same. A CISO should read this batch as a structural recurrence signal, not an isolated incident.

Why “unauthenticated” privilege escalation is a real risk

Privilege escalation on a workstation is often treated as second-tier, behind code execution. That is a mistake. In practice, the modern attack chain almost always pairs a weak initial compromise with a local escalation.

The typical scenario plays out in two steps. First, the attacker gets a low-privileged foothold — a phishing click, an exposed service account, a machine already compromised on the network. Then they use an escalation primitive like CVE-2026-108186 to move from that limited account to SYSTEM or an administrator, and that is the moment they drop ransomware, exfiltrate data, or move laterally.

The no-authentication detail makes it worse: there is no barrier before the attempt. If the Zoom service is reachable — and on a corporate LAN it usually is — the flaw is attackable. The only reliable mitigation is the patch, not network configuration.

What to do, in three checks

The head fix is Zoom Workplace 7.1.8 for Windows, which covers both CVEs at once — 7.1.8 being above the 7.1.5 threshold (CVE-2026-108187) and outside the vulnerable 7.1.x range (CVE-2026-108186). Verification is a single command, run on each machine.

# Installed version of the Zoom Workplace client (Windows)
(Get-Item "$env:APPDATA\Zoom\bin\Zoom.exe").VersionInfo.FileVersion

If the version is below 7.1.8, the endpoint is exposed. For a managed fleet, three reflexes cover it:

• Force the update through your management console — Zoom auto-updates its clients, but enterprise policy can delay it. Confirm auto-update is not blocked.
• Inventory unmanaged endpoints — remote-work machines and BYOD devices running a personal Zoom client often escape the inventory.
• Treat escalation as one link in the chain — this fix only protects if the rest of the fleet is current. A machine with patched Zoom but a vulnerable VPN client is still an open door.

Zoom says it has no evidence of in-the-wild exploitation at publication time. That is good news, but fragile: network privilege-escalation flaws in software this widely deployed attract exploit developers as soon as the patch diff becomes readable.

Verdict

If you run Zoom Workplace on Windows, upgrade to 7.1.8 before the end of the week, and push the update across the fleet rather than relying on auto-update. CVE-2026-108186 turns a plain network connection into an unauthenticated privilege escalation: exactly the link attackers look for between initial compromise and high-privileged execution. If your fleet does not run Zoom, the risk here is nil — but note the signal: a vendor patching three flaws of the same class in four months warrants a review of your entire videoconferencing surface, whoever the provider is.

References

• The Hacker News — “Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation” (Ravie Lakshmanan, November 11, 2026)
• Zoom Security Bulletin ZSB-26023 — CVE-2026-108186
• Zoom Security Bulletin ZSB-26024 — CVE-2026-108187
• ETTAYEB — our analysis of the “Zoomsday” zero-click flaw (August 2026)