Zoom fixes two Windows Workplace flaws, including a critical bug that could let unauthenticated attackers remotely escalate privileges.
Zoom has released security updates to fix two vulnerabilities in Zoom Workplace for Windows. One is critical and could let attackers gain higher privileges on affected systems.
The vulnerabilities are:
- CVE-2026-108186 (CVSS 9.6): An input validation flaw that could allow an attacker to gain higher privileges through a network connection, without logging in.
- CVE-2026-108187 (CVSS 8.1): An origin validation flaw that could also allow an unauthenticated attacker to gain higher privileges remotely.
If successfully exploited, either vulnerability could allow attackers to increase their privileges without having an account or any special permissions on the affected system. Users should install the latest Zoom Workplace updates to protect their systems.
The first flaw was reported by the internal security team, while the second one was reported by the research shmoul.
CVE-2026-108187 affects Zoom Workplace for Windows releases earlier than 7.1.5, while CVE-2026-108186 impacts versions from 7.1.0 up to, but not including, 7.1.8.
The flaw can corrupt memory through a specially crafted message. Attackers could exploit it to target meeting participants, execute code without user interaction, steal data, activate cameras or microphones, and install malware.
In August, Zoom patched four vulnerabilities, including a critical zero-click flaw, tracked as CVE-2026-53413. CVE-2026-53413 is a memory corruption issue found by A Security that could allow a meeting participant to execute code on another participant’s computer.
Due to its impact, the researchers dubbed the flaw “Zoomsday,” it affects Zoom clients on all supported platforms and is linked to the proprietary protocol used by the annotation function. Zoom has now begun rolling out security updates to address the issue.
“Ⓐ Security, the Autonomous Offensive Security and Remediation Platform, discovered a critical flaw in Zoom that let an attacker take complete control of another user’s device during a live call. No click, no download, and nothing required of the victim but being in the meeting.” reads the report published by A Security. “The vulnerability is present in every version of Zoom on every device and operating system: Windows, Mac, iPhone, Android and Linux. The vulnerability exists in all versions up to and including 7.0.5.”
The flaw can corrupt memory through a specially crafted message. Attackers could exploit it to target meeting participants, execute code without user interaction, steal data, activate cameras or microphones, and install malware.
In July, Zoom fixed another critical Windows vulnerability, tracked as CVE-2026-53412 (CVSS score of 9.8), that could allow unauthenticated attackers to hijack user accounts. The flaw affects older versions of Workplace, the Windows VDI Client, and the Meeting SDK for Windows.
At this time, Zoom is not aware of attacks exploiting one of the above vulnerabilities. Users are recommended to apply the latest updates.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CVE-2026-108186)
