Introduction
A critical input validation flaw in Zoom Workplace for Windows, rated 9.6 by Zoom, may let an unauthenticated attacker with network access escalate privileges on a user's machine, provided some form of user interaction takes place. Zoom shipped the fix silently on August 31, 2026, roughly ten weeks before the November 10 advisory. That timing means the hosts most likely to remain exposed are the ones where client updates are pinned or suppressed, such as managed MSI deployments and VDI golden images.
Zoom disclosed the issue as CVE-2026-108186 in Security Bulletin ZSB-26023. The finding is credited to Zoom Offensive Security, Zoom's internal team. Below we summarize what the vendor and vulnerability records say, what they leave out, and how to verify whether a given Windows endpoint is still in the affected range.
Technical information
Root cause
The CVE record classifies the bug as CWE-20: Improper Input Validation and describes it as a possible escalation of privilege by an unauthenticated user via network access. Zoom Video Communications, Inc. is the CNA, and NVD's record mirrors Zoom's data. NVD currently marks the entry as awaiting enrichment.
Zoom has not published the specific input, the processing path in the client that mishandles it, or any root cause analysis. Zoom Workplace is closed source and no code diff exists, so we are not including any code snippets. Anything more specific than "the Windows client trusted input it should have checked" would be speculation.
Reading the CVSS vector
The published vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Broken down:
- AV:N (Network): the attacker reaches the vulnerable component over the network.
- AC:L (Low complexity): no special conditions outside the attacker's control are needed.
- PR:N (No privileges): the attacker needs no account or credentials.
- UI:R (User interaction required): a user must take some action. The sources do not say what that action is.
- S:C (Scope changed): impact extends beyond the vulnerable component itself.
- C:H / I:H / A:H: high impact to confidentiality, integrity, and availability.
The UI:R requirement is what keeps this at 9.6 rather than higher. It is also the main open question for defenders, since the nature of the interaction determines how practical exploitation would be.
Attack flow
Based only on the CWE and CVSS data, the attack the patch closes looks like this:
- An attacker with no credentials reaches a Zoom Workplace for Windows client (7.1.0 through 7.1.7) over the network.
- A user performs some unspecified interaction.
- The client processes attacker-supplied input without adequate validation.
- The result is privilege escalation with a changed scope, so the impact reaches resources beyond the vulnerable component, with high potential impact to confidentiality, integrity, and availability.
The resulting privilege level, the exact input vector, and the interaction trigger are not public.
Exploitation status
Neither the Zoom bulletin nor the CVE and NVD records report exploitation in the wild or name a threat actor. CISA's Known Exploited Vulnerabilities feed released November 9, 2026 (1,773 entries) did not contain CVE-2026-108186. Its absence from that catalog version is not proof that exploitation has never occurred. No public proof of concept has been identified.
Patch information
The fix is a vendor binary update delivered through Zoom's normal client update channel. There is no commit or source patch to review, so the fix is defined entirely by version numbers.
First fixed build: 7.1.8 (46825), Windows only. ZSB-26023 does not name a fixed version and instead tells users to install the latest update from Zoom's download center. Zoom's Workplace release notes fill that gap. The August 31, 2026 release shipped Windows build 7.1.8 (46825), and its only Windows entry under Resolved issues is the generic line "Security enhancements." The 7.1.8 builds for other platforms released the same day list only minor bug fixes, which matches the Windows-only scope of the CVE. Since the affected range ends right before 7.1.8, this release is the effective patch.
Silent fix, roughly ten weeks of embargo. The fix shipped August 31, and the advisory followed on November 10. Because the bug was found internally, Zoom could push the fix through automatic updates before publishing anything that points attackers at the affected code. In practice:
- Windows machines that were updating automatically between late August and November were already protected before the CVE was public.
- Machines with updates pinned or suppressed (for example through MSI or GPO update policies, or VDI golden images) may still be running 7.1.0 through 7.1.7. That group is the real exposure.
Later releases also contain the fix. Zoom's release notes list these subsequent Windows builds, all above the affected range:
- 7.1.8 (46825): August 31, 2026 (first fixed)
- 7.2.0 (48358): September 18, 2026
- 7.2.1 (48556): September 21, 2026
- 7.1.9 (48550): September 24, 2026 (slow track, prompted only)
- 7.2.5 (51704): October 31, 2026 (latest listed)
Compare version strings, not build numbers. Build numbers are not monotonic across branches: 7.2.0 is build 48358, while the later-dated 7.1.9 is build 48550. Any version at or above 7.1.8 is outside the affected range.
What the patch changes internally is not public. Without vendor details or a binary diff, the exact validation logic added cannot be confirmed.
Affected systems and versions
- Product: Zoom Workplace for Windows
- Affected: version 7.1.0 up to, but not including, 7.1.8 (that is, 7.1.0 through 7.1.7 inclusive)
- Not affected: 7.1.8 and every later version, including 7.1.9, 7.2.0, 7.2.1, and 7.2.5
- Platform scope: Windows only, per the bulletin and NVD record
- Configurations warranting priority review: endpoints where automatic client updates are disabled or controlled centrally, such as MSI- or GPO-managed installs and VDI golden images, since these are the most likely to have missed the August 31 fix
Zoom published no workaround or compensating control. Updating is the only documented remediation.
Vendor security history
In November 2020, the Federal Trade Commission announced a settlement with Zoom after alleging that the company misrepresented aspects of its encryption and maintained cryptographic keys that could allow it to access meeting content. The settlement required Zoom to assess and document security risks annually and to implement a vulnerability management program. Zoom's later filing states the FTC voted to make the settlement final on January 19, 2021. These facts describe the allegations and settlement terms. Nothing in the sources connects them to CVE-2026-108186.
The current disclosure follows a standard coordinated disclosure pattern. Zoom's own offensive security team found the bug, Zoom fixed it in a regular release, and the advisory came after the fix had time to propagate.
References
- NVD: CVE-2026-108186
- CVE Record: CVE-2026-108186
- Zoom Security Bulletin ZSB-26023
- Zoom Workplace release notes (KB0061222)
- Zoom download center
- CISA Known Exploited Vulnerabilities Catalog
- CISA Known Exploited Vulnerabilities JSON feed
- FTC: FTC Requires Zoom to Enhance its Security Practices as Part of Settlement
- Zoom fiscal 2026 Form 10K (SEC)
- Zoom fiscal 2025 Form 10K (SEC)
- Zoom Form 10K filed February 27, 2026 (Investor Relations)
