Zoom Workplace for Windows Updates Fix Two Privilege-Escalation Flaws
Tech GuruQuick Answer
Update Zoom Workplace for Windows to 7.1.8 or later. Confirm managed installations and running clients, test meeting and sign-in workflows, and retain deployment and version evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Record Windows client versions, user and machine installations, update policies and application owners. Match each CVE range separately. These bulletins do not establish exposure of Zoom Rooms, macOS, Linux, mobile clients or SDKs. Deploy the current supported Zoom Workplace Windows update, at least 7.1.8, through the official download or managed distribution channel. Relaunch the application, confirm the loaded version for managed users and test sign-in, meetings and required integrations. Review suspicious client behavior where warranted and retain records.
Last verified: 2026-11-10 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Zoom Workplace for Windows |
|---|---|
| Advisory | ZSB-26023 / ZSB-26024 |
| CVEs | CVE-2026-108186, CVE-2026-108187 |
| Authoritative release date | November 10, 2026; both Zoom bulletins list this initial publication date without a time. |
| Authority revision date | Initial version 1.0 for both bulletins; no later revision stated. |
| Affected versions | CVE-2026-108186: versions 7.1.0 through versions before 7.1.8. CVE-2026-108187: versions before 7.1.5; no lower affected-version boundary is stated. |
| Fixed version | Zoom Workplace for Windows 7.1.8 or later addresses both advisories; 7.1.5 is the threshold for CVE-2026-108187 only |
| CVSS base score | 9.6 (CVE-2026-108186); 8.1 (CVE-2026-108187), official CVSS v3.1 base scores |
| CVSS severity | Critical (CVE-2026-108186); High (CVE-2026-108187) |
| Exploitation status | Zoom does not state malicious exploitation in these bulletins.; no exploitation claim is inferred. |
What Changed
Zoom disclosed improper input validation and origin-validation flaws that may allow an unauthenticated user to escalate privileges through network access. Both published CVSS vectors require user interaction; the affected version ranges differ.
What To Validate Now
- Inventory. Record Windows client versions, user and machine installations, update policies and application owners.
- Establish applicability. Match each CVE range separately. These bulletins do not establish exposure of Zoom Rooms, macOS, Linux, mobile clients or SDKs.
- Remediate. Deploy the current supported Zoom Workplace Windows update, at least 7.1.8, through the official download or managed distribution channel.
- Validate. Relaunch the application, confirm the loaded version for managed users and test sign-in, meetings and required integrations. Review suspicious client behavior where warranted and retain records.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Version 7.1.5 addresses only the origin-validation bulletin and remains within the input-validation range. Avoid interpreting the Critical score as evidence of exploitation or expanding the scope to other Zoom products.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
