Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation - The Hacker News
Zoom has released software updates to address two security vulnerabilities in Zoom Workplace for Windows, including a critical bug that could enable unauthenticated remote privilege escalation.
The vulnerabilities, CVE-2026-108186 and CVE-2026-108187, both allow unauthenticated users to escalate privileges via network access. The first flaw has a CVSS score of 9.6 and affects Zoom Workplace for Windows versions starting from 7.1.0 before 7.1.8, while the second scores 8.1 and impacts versions before 7.1.5.
Potential Impact
Successful exploitation of either vulnerability could permit remote attackers to gain elevated privileges on affected systems without requiring any special permissions or access. While Zoom has not reported any active exploitation of these flaws in the wild, the company has urged users to apply the latest patches to mitigate potential threats.
Users are advised to apply the latest patches to mitigate potential threats.
Previous Vulnerabilities
This isn't the first time Zoom has addressed critical security issues in Workplace for Windows. Earlier this July, the platform shipped fixes for another improper input validation flaw (CVE-2026-53412, CVSS score: 9.8) that could enable unauthenticated users to take control of accounts. The company continues to work on improving security measures for its widely used videoconferencing platform.
Related
