Zoom has patched two serious vulnerabilities in its Zoom Workplace app for Windows, including a critical bug that could let attackers elevate privileges remotely without authentication. The update aims to address risks posed by flawed input and origin validation in affected versions.
What’s at Risk
The first issue, tracked as CVE-2026-108186 and carrying a 9.6 CVSS score, stems from improper input validation. It allows someone with no prior permissions to potentially gain higher access over the network. The second, CVE-2026-108187, rated 8.1, involves origin validation — similarly exploitable by unauthenticated users remotely.
Not all Windows users are affected the same way: CVE-2026-108187 impacts versions released before Zoom Workplace 7.1.5. The more severe CVE-2026-108186 covers installs from version 7.1.0 through 7.1.8.
Recent Patch History & Urgency
This isn’t Zoom’s first major security fix this year. In July, the company patched CVE-2026-53412 — an improper input validation flaw that similarly granted attackers elevated access to accounts with no credentials. That one carried a 9.8 CVSS score, signaling especially high severity.
While there’s no indication that the latest bugs under CVE-2026-108186 or CVE-2026-108187 are being exploited in the wild, Zoom is urging users to install the latest Workplace version to close these serious gaps.
Where to Go From Here
If your organization runs Zoom Workplace on Windows and you’re using any version from 7.1.0 up to but not including 7.1.8, immediate updating is vital. Even systems below 7.1.5 are vulnerable due to the origin validation flaw. Once updated, verify versions and confirm that all Windows endpoints are secured against exploitation attempts.
These deficiencies in input and origin validation are common avenues for escalations, and tools like Zoom — which sit at the intersection of remote work, communications, and networking — are frequent targets.
Broader Implications
This situation underscores a growing trend: enterprise communication tools are being scrutinized more than ever as potential entry points for attacks. Broken validation bugs consistently rank among the most dangerous, especially when they’re exploitable unauthenticated. This incident reinforces that even trusted software must be regularly audited and patched.
My take: The severity of these vulnerabilities — combined with the ease of exploit and widespread deployment of Zoom Workplace — makes this a critical update for many organizations. Beyond just applying patches, firms should conduct a thorough assessment of their security policies around remote access, least privilege enforcement, and regular vulnerability scanning. Watch for any signs of exploitation now that details are public — attackers often move fast once fixes go live.
