Zoom released updates and security bulletins on November 11 that fix two privilege-escalation flaws in Zoom Workplace for Windows, including CVE-2026-108187, which Zoom rates critical. Either flaw could let a remote attacker escalate privileges without any special permissions, according to The Hacker News.
Two Zoom Workplace Flaws and the Versions They Affect
The two vulnerabilities cover overlapping but different version ranges, and Zoom’s bulletins treat them separately.
CVE-2026-108187: Critical Flaw in Builds Before 7.1.5
CVE-2026-108187 is the critical issue. It affects Zoom Workplace for Windows versions before 7.1.5. The source report does not state a CVSS score for it, and no score is given here.
CVE-2026-108186: Flaw in Versions 7.1.0 Up to 7.1.8
CVE-2026-108186 affects versions from 7.1.0 up to, but not including, 7.1.8. That range means clients on builds between 7.1.5 and 7.1.7 are covered by the second flaw even after clearing the first. The report likewise gives no CVSS score for this vulnerability.
What the Zoom Workplace Flaws Allow Attackers to Do
Both vulnerabilities can let remote attackers escalate privileges with no special permissions. The report does not describe the technical mechanism of either flaw, the component involved or the conditions required to trigger them. Details on how an attacker would reach the vulnerable code remain unpublished in the sources reviewed.
Exploitation Status and Earlier Zoom Fix
Zoom does not report exploitation of either flaw. No attacks or public exploit code were described in the coverage.
Comparison With the July CVE-2026-53412 Fix
The Hacker News noted that in July Zoom fixed CVE-2026-53412, rated CVSS 9.8, in the same product. That earlier bug and the two new ones all affect Zoom Workplace for Windows, which makes the product a repeat subject of critical-severity bulletins during 2026.
SecurityWeek also reported the Zoom patches, but the fetch of that article was not completed, so this report relies on The Hacker News.
Windows Clients on Older Builds Remain Exposed
Windows clients on older builds are exposed until they update. Zoom’s guidance, as relayed in the coverage, is to update to the latest Zoom Workplace for Windows release. Because the vulnerable ranges end at 7.1.5 for CVE-2026-108187 and 7.1.8 for CVE-2026-108186, a build at or above 7.1.8 falls outside both ranges.
The privilege-escalation label matters for how the flaws might be used. A flaw that raises privileges generally serves as one step in a longer attack chain rather than as an entry point on its own, though the report itself does not describe any chain. Zoom’s bulletins and the Hacker News summary do not identify the researcher or team who reported the flaws, and the vendor has not released additional technical detail.
The disclosure includes few specifics beyond the version ranges and severity labels. Until Zoom or an independent researcher publishes more information, the public record consists of the bulletin classifications, the affected versions and the vendor’s statement that it knows of no exploitation.
Sources and Missing Detail in the Zoom Bulletins
The Hacker News is the main source for the Zoom disclosure, with SecurityWeek also reporting on the patches. Zoom published its updates and bulletins on November 11. The coverage lists the affected version ranges for each CVE but does not state a CVSS score for either flaw, and no score is invented here.
The July fix for CVE-2026-53412 in the same product, rated CVSS 9.8, is the only previous Zoom Workplace vulnerability cited in the reports. Together with the two new bulletins, it gives three critical-class or high-profile Zoom Workplace for Windows fixes within the year, according to the coverage.
Zoom reports no exploitation of CVE-2026-108187 or CVE-2026-108186. The vendor’s statement is the only available indicator of real-world use, and the sources include no independent confirmation from threat intelligence firms.
