Zoom recommends installing the latest available update; users can check their version under Help > About Zoom Workplace and update through Check for Updates or Zoom’s official download center.

Zoom disclosed two vulnerabilities in Zoom Workplace for Windows that could allow unauthenticated attackers with network access to escalate privileges, though both require user interaction.

The more severe flaw, CVE-2026-108186, is an input-validation bug rated critical at CVSS 9.6, affecting versions 7.1.0 through releases earlier than 7.1.8.

The second flaw, CVE-2026-108187, stems from an incorrect origin check, is rated high at CVSS 8.1, and affects releases earlier than 7.1.5.

Zoom’s Offensive Security team found the critical flaw, while researcher shmoul reported the second; Zoom said neither has been confirmed exploited in the wild.

Zoom’s advisories provide limited technical detail, including no explanation of what user action could trigger an attack or a complete exploitation chain.

Zoom Workplace for Windows 7.1.8 fixes CVE-2026-108186 and version 7.1.5 fixes CVE-2026-108187; the current 7.2.5 release includes fixes for both.

Organizations should find vulnerable installations across managed Windows devices, deploy and verify updates through approved tools, and monitor for suspicious privilege changes or application behavior.

The severity scores describe potential impact, not confirmed compromise, but delayed updates to widely used workplace software can leave organizations exposed.

The disclosures follow other Zoom security issues cited in the article, including the August 2026 “Zoomsday” zero-click memory-corruption flaw, CVE-2026-53413, and a critical Windows account-takeover vulnerability fixed in July, CVE-2026-53412.