// AI threat desk · 15 Nov 2026
Home/CVE · Vulns & Patches
Vulns & PatchesCriticalPATCHCVSS 9.8 / 9.6 / 8.1

Zoom Workplace for Windows flaw could enable privilege escalation

Zoom released updates for two Windows flaws, including an improper input validation bug that could let unauthenticated users escalate privileges through network access.

· 2 min read
AI-generated image of hands at a Windows workstation beside blurred network equipment.
AI-generated image, not a photo of the event.
Key takeaways
  • Zoom released updates for two security flaws affecting Zoom Workplace for Windows.
  • Zoom said the improper input validation flaw has a CVSS score of 9.6 and could allow an unauthenticated user to escalate privileges through network access.
  • Zoom said the origin validation flaw has a CVSS score of 8.1 and could allow an unauthenticated user to escalate privileges through network access.

Zoom has released updates for two security flaws in Zoom Workplace for Windows, including an improper input validation vulnerability that could let an unauthenticated user escalate privileges through network access.

The affected software includes Zoom Workplace for Windows versions starting at 7.1.0 and before 7.1.8. A second flaw affects versions before 7.1.5 and could also allow an unauthenticated user to escalate privileges through network access.

Earlier in July, Zoom shipped fixes for another improper input validation flaw in Zoom Workplace for Windows, which The Hacker News reported could enable an unauthenticated user to take control of accounts.

On this page

Affected Windows versions for both flaws

Zoom said the improper input validation vulnerability affects Zoom Workplace for Windows versions starting from 7.1.0 and before 7.1.8. The company described the issue as one that could let an unauthenticated user conduct an escalation of privilege via network access.

VulnerabilityAffected version
Improper input validationStarting from 7.1.0 and before 7.1.8
Origin validationBefore 7.1.5

Zoom also fixed an earlier Windows flaw

The Hacker News reported that Zoom shipped fixes in July for another improper input validation flaw in Zoom Workplace for Windows (CVE-2026-53412, CVSS score 9.8) that could enable an unauthenticated user to take control of accounts.

TechRepublic reported that Zoom addressed that vulnerability alongside three high-severity Windows flaws that could allow authenticated local users to elevate their privileges.

BleepingComputer reported that Zoom warned of a critical Windows desktop client and software development kit vulnerability that could be exploited by an unauthenticated party to hijack accounts. TechRepublic reported that Zoom patched a critical Windows flaw that could enable remote account takeover, along with three high-severity privilege-escalation vulnerabilities.

Zoom’s security bulletin says users can help keep themselves secure by applying the latest updates available at its download site.

What to do now

  1. Inventory all Zoom Workplace, VDI Client, Meeting SDK and Zoom Rooms deployments, then upgrade supported installations and remove unmanaged, legacy or obsolete components to reduce the attack surface.

FAQ

What happened to Zoom Workplace for Windows?

Zoom released updates addressing two security flaws in Zoom Workplace for Windows, including an improper input validation vulnerability and an origin validation vulnerability.

Which Zoom Workplace versions are affected by the improper input validation flaw?

Zoom said the flaw affects Zoom Workplace for Windows starting from version 7.1.0 and before version 7.1.8.

Which Zoom Workplace versions are affected by the origin validation flaw?

The origin validation flaw affects Zoom Workplace for Windows before version 7.1.5.

Could the Zoom flaws be exploited without authentication?

Zoom said both vulnerabilities could allow an unauthenticated user to escalate privileges through network access.

How should users address the Zoom Windows vulnerabilities?

Zoom said users should apply the latest available updates. TechRepublic recommended inventorying Zoom deployments, upgrading supported installations and removing unmanaged, legacy or obsolete components.

Sources

  1. ZSB-26023, ZoomPrimary
  2. Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation, The Hacker News
  3. Zoom warns of critical account takeover vulnerability, BleepingComputer
  4. Critical Zoom Flaw Could Let Attackers Take Over Windows Accounts, TechRepublic
  5. Update Zoom Workplace before August 10, Medicine Buffalo
  6. Zoom issues a warning to Windows users about critical security flaw, BetaNews
How we checked this story
ClaimSourceStatus
Zoom released software updates addressing two security flaws impacting Zoom Workplace for Windows.Zoom, via The Hacker NewsAttributed
Zoom said cVE-2026-108186 has a CVSS score of 9.6 and could allow an unauthenticated user to escalate privileges through network access.Zoom, via The Hacker NewsAttributed
Zoom said cVE-2026-108187 could allow an unauthenticated user to escalate privileges through network access.Zoom, via The Hacker NewsAttributed
CVE-2026-108187 affects Zoom Workplace for Windows before version 7.1.5.Zoom, via The Hacker NewsAttributed
Zoom said cVE-2026-108186 affects versions starting from 7.1.0 and before 7.1.8.Zoom, via The Hacker NewsAttributed
Zoom's security bulletin says users should apply the latest available updates.ZoomConfirmed
Zoom's security bulletin says the improper input validation flaw affects Zoom Workplace for Windows starting on version 7.1.0 and before version 7.1.8.ZoomConfirmed
BleepingComputer reported that Zoom warned of a critical Windows desktop client and software development kit vulnerability that could hijack accounts without authentication.BleepingComputerAttributed
TechRepublic reported that Zoom patched a critical Windows flaw enabling remote account takeover and three high-severity privilege-escalation vulnerabilities.TechRepublicAttributed
TechRepublic reported no evidence that Zoom's vulnerabilities were actively exploited.TechRepublicAttributed
Zoom shipped fixes in July for CVE-2026-53412, an improper input validation flaw that could let an unauthenticated user take control of accounts.Zoom, via The Hacker NewsAttributed
Zoom addressed CVE-2026-53412, rated 9.8 out of 10, alongside three high-severity Windows flaws that could let authenticated local users elevate privileges.Zoom, via TechRepublicAttributed
CVE-2026-53412 received a CVSS score of 9.8 and was the most severe issue in Zoom's latest update.Zoom, via TechRepublicAttributed
BleepingComputer reported that CVE-2026-53412 was the most serious issue in Zoom's latest security release and received a CVSS score of 9.8.BleepingComputer, via TechRepublicAttributed

Could not verify

  • Whether either CVE-2026-108186 or CVE-2026-108187 has been exploited in the wild is not established.
  • How many Zoom installations or users are affected is not established.
  • Whether the current vulnerabilities are linked to the earlier CVE-2026-53412 is not established.
  • Whether Zoom Workplace for platforms other than Windows is affected is not established.
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok