Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation

Zoom has issued updates to patch two security vulnerabilities affecting its Zoom Workplace for Windows, including a critical flaw that could lead to privilege escalation. The vulnerabilities, identified as CVE-2026-108187 and CVE-2026-108186, could allow remote attackers to gain elevated privileges without needing any special access permissions. This poses a significant risk as it could enable unauthorized users to execute commands or access sensitive data on affected systems.

CVE-2026-108187 affects versions of Zoom Workplace for Windows prior to 7.1.5, while CVE-2026-108186 impacts versions from 7.1.0 up to but not including 7.1.8. The nature of these vulnerabilities means that attackers could potentially exploit them to escalate their privileges, thereby gaining unauthorized access to system resources. This type of vulnerability is particularly concerning because it can allow attackers to bypass normal security controls and execute malicious activities.

Earlier this year, in July, Zoom addressed another critical flaw in its Workplace application for Windows, CVE-2026-53412, which also had a high severity rating with a CVSS score of 9.8. This earlier flaw involved improper input validation, which could have allowed an unauthenticated user to take control of accounts. Although there are no reports of these vulnerabilities being actively exploited in the wild, Zoom is urging users to update their software to the latest versions to protect against potential threats.