Zoom published two security bulletins on November 10 for Zoom Workplace for Windows. CVE-2026-108186 is rated critical at CVSS 9.6 and affects versions 7.1.0 up to 7.1.8. CVE-2026-108187 is rated high at 8.1 and affects versions before 7.1.5. Both let an unauthenticated attacker escalate privileges over the network. Mac, Linux and mobile apps are not listed.
If you run Zoom on a Windows PC, update it to version 7.1.8 or later today. Zoom published two security bulletins on November 10 for Zoom Workplace for Windows, and one of them, ZSB-26023, is rated critical with a CVSS score of 9.6.
What changed
Zoom’s bulletins list two flaws in the Windows desktop app:
- CVE-2026-108186, critical, CVSS 9.6. Improper input validation that Zoom says “may allow an unauthenticated user to conduct an escalation of privilege via network access.” It affects Zoom Workplace for Windows from version 7.1.0 up to, but not including, 7.1.8. Zoom credits its own Offensive Security team with the find.
- CVE-2026-108187, high, CVSS 8.1. An origin validation error with the same outcome, described in ZSB-26024. It affects Zoom Workplace for Windows before version 7.1.5.
Version 7.1.8 is the first release outside both ranges. Both bulletins name only Zoom Workplace for Windows. The Mac, Linux, iOS and Android apps are not listed.
Zoom’s own scoring says both attacks come over the network, need no account or privileges, and need some action from the person being targeted. The bulletins do not say what that action is, and Zoom has published no technical details.
No sign of attacks yet
Neither bulletin says the flaws are being used in attacks. The Hacker News, which reported the bulletins on November 11, also notes that Zoom makes no mention of exploitation. That can change quickly once a fix is public, because attackers compare the old and new versions to find the bug.
This is the second critical Zoom Workplace for Windows flaw this year. In July, Zoom fixed CVE-2026-53412, rated 9.8, which The Hacker News reported could let an unauthenticated user take over accounts.
How to update
- On your own PC: open the Zoom desktop app, click your profile picture, choose Check for Updates and install what it offers. You can also download the current installer from zoom.us/download.
- Check the version: the same profile menu shows it under Help, then About Zoom Workplace. You want 7.1.8 or higher.
- If your company manages Zoom: ask IT when 7.1.8 or later reaches your machine. Admins who pin a version through the MSI installer or a device management tool need to move that pin.
Patch Zoom the same week as Windows
Zoom’s bulletins landed on Microsoft’s Patch Tuesday, the same day as the November Windows and Outlook fixes. A remote team on Windows laptops has two updates to confirm this week, and Zoom is the easier one to miss because it updates on its own schedule, outside Windows Update.
If you lead a small team with no IT department, ask everyone on Windows to post their Zoom version in chat. It takes two minutes, and Zoom is the app your team uses to click links and join calls from people outside the company. A flaw that needs a click from the target is a real risk in that app.