Zoom patches critical Workplace flaw (CVSS 9.6) enabling unauthenticated privilege escalation

Zoom shipped patches for two security flaws in Zoom Workplace for Windows, including CVE-2026-108186, rated 9.6 on the CVSS scale. The vendor says the defect stems from improper input validation and can let an unauthenticated attacker escalate privileges over the network. The affected range starts at 7.1.0 and ends before 7.1.8. A second bug, CVE-2026-108187, rated 8.1, affects versions before 7.1.5 and also involves origin validation.

The evidence is the vendor advisory and the CVE records themselves. They establish a high severity score, a network attack path, and no required prior access, which is the combination that makes remote exploitation attractive. Zoom does not report active exploitation in the supplied material, so the current trail is technical disclosure, not confirmed incident telemetry. Still, the score and the missing authentication requirement are enough to treat this as an urgent patch-management problem rather than a theoretical bug.

Context matters because this is not an isolated slip. In July, Zoom fixed CVE-2026-53412, a 9.8 improper input validation flaw that could let an unauthenticated user take control of accounts. Repeated high-severity network-facing bugs in the same product line suggest a pattern in how input handling and trust boundaries are tested. For a tool that sits on laptops used by employees, contractors, and executives, the operational risk is not just a meeting interruption. It is a foothold on the endpoint.

Next, expect defenders to inventory Zoom Workplace installations, push version 7.1.8 or later, and check whether older 7.1.5 builds remain exposed to CVE-2026-108187. Security teams should look for abnormal privilege changes, unexpected child processes spawned by Zoom components, and outbound network activity after meeting joins. The absence of known exploitation today is not a clean bill of health. In vulnerability management, disclosure often starts the race between patch cycles and proof-of-concept code.