As reported by SecurityAffairs, Zoom has patched two unauthenticated privilege escalation vulnerabilities in Zoom Workplace for Windows — including a critical CVSS 9.6 input validation flaw that requires no login credentials to exploit. This is a significant exposure profile for a product installed on millions of endpoints across enterprise, government, and educational environments.
Why This Matters
The distinguishing risk factor here is unauthenticated remote exploitation. Most privilege escalation vulnerabilities in collaboration software chains assume some prior foothold — a user clicking a link, opening a file, or joining a session. These two CVEs break that assumption. An attacker on the same network — or potentially reachable via Zoom's relay infrastructure — could escalate privileges without an account or session participation. That changes the threat model from "someone in your meeting" to "someone on your network perimeter."
For organizations still running hybrid or remote-first environments where Zoom is a core collaboration layer, this represents a meaningful privilege boundary collapse. Elevated local privileges on a workstation are the bridge between initial access and full domain compromise — exactly the escalation step ransomware operators and initial access brokers look for.
Vulnerability Details
| CVE | CVSS | Severity | Affected Versions | Patched In | Exploited in Wild |
|---|---|---|---|---|---|
| CVE-2026-108186 | 9.6 | Critical | 7.1.0 up to (not including) 7.1.8 | 7.1.8+ | No confirmed reports |
| CVE-2026-108187 | 8.1 | High | Prior to 7.1.5 | 7.1.5+ | No confirmed reports |
Both vulnerabilities allow unauthenticated attackers to escalate privileges remotely. CVE-2026-108186 is the more severe of the two, with a CVSS vector indicating network-based exploitation, no authentication, and high impact across confidentiality, integrity, and availability. Both were reported responsibly — the first by Zoom's internal team, the second by external researcher shmoul.
Broader Context
This is not Zoom's first critical flaw this year. In August, the company patched CVE-2026-53413 — dubbed "Zoomsday" — a zero-click memory corruption vulnerability in the annotation protocol affecting all supported platforms up to version 7.0.5. That flaw allowed code execution during a live meeting without victim interaction.
Collaboration platforms have become high-value targets precisely because their core function — real-time communication between trusted parties — creates natural trust boundaries that attackers exploit. The pattern at Zoom is concerning: critical flaws recurring every few months, often with network-reachable or zero-click characteristics.
Who Is Most At Risk
Shield53 Recommendations — Immediate Actions
- Patch now. Upgrade all Zoom Workplace for Windows installations to version 7.1.8 or later. This addresses both CVEs in a single update.
- Audit version sprawl. Use your endpoint management tooling (MECM, Intune, Jamf) to inventory all Zoom client versions. Unmanaged or shadow installs are the primary blind spot.
- Block legacy versions. If you cannot patch immediately, consider application control policies to block execution of Zoom versions below 7.1.8 on sensitive systems.
- Network segmentation. Because CVE-2026-108186 is network-exploitable, ensure workstations are not directly exposed to untrusted network segments. This is basic defense-in-depth but often neglected on collaboration endpoints.
- Detection monitoring. Watch for unexpected privilege escalation events on Zoom-installed hosts — new service creation, unexpected child processes spawned by Zoom binaries, or elevation of the Zoom process integrity level.
- Vendor management. If your organization allows external parties (vendors, partners) to use Zoom on managed devices, enforce version requirements in your vendor security policy.
The frequency of critical Zoom vulnerabilities in 2026 suggests the platform remains under active security scrutiny. That is healthy — but it also means defenders must treat collaboration client patching with the same urgency as OS-level security updates. A lingering unpatched Zoom client is now a credible initial access vector, not just a hygiene issue.
