Brief Summary: CVE-2026-108187, an Origin Validation Error Enabling Privilege Escalation in Zoom Workplace for Windows

Introduction

Zoom Workplace runs on a large share of corporate Windows desktops, so a flaw that lets an unauthenticated network attacker escalate privileges through the client matters to most enterprise endpoint fleets. Zoom shipped the fix for CVE-2026-108187 in a July 2026 client release but did not publish the advisory, ZSB 26024, until November 10, 2026. Many organizations are therefore already covered, while others may still be running older builds.

In this post we summarize what Zoom and the CVE record say, where the public detail stops, and how to confirm that your endpoints are on a fixed build.

Technical information

Root cause

The CVE record classifies the issue as CWE 346, Origin Validation Error. Zoom's description is short: an origin validation error in Zoom Workplace for Windows "may allow an unauthenticated user to conduct an escalation of privilege via network access."

In practical terms, an origin validation error means the Windows client accepted input or requests from a network source without properly checking that the source was trusted. Zoom Workplace is closed source, and Zoom has not published a code diff, commit, or technical writeup, so the specific failed origin check and the vulnerable processing path are not public. We have not reproduced any vulnerable code here because none has been released.

CVSS vector breakdown

Zoom and the CVE record publish the following CVSS 3.1 vector, scored 8.1 (High):

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

The vector models risk and does not describe an exploit. The 8.1 score also comes from Zoom as the CNA. NVD's page states that an NVD assessment had not yet been provided, so this should not be described as an independent NIST severity determination.

Attack flow (as implied by the vector)

Zoom has not described the exploitation steps. The following outline is derived only from the CVSS vector and the weakness class, and should be read as a model rather than a confirmed chain:

1. The attacker has network reach to the victim but holds no Zoom account or privileges on the target (PR:N).
2. The victim must take an action (UI:R). Zoom does not say what this is. The vendor patch notes give visiting a page or clicking a link as examples consistent with this vector, but those examples are inferred, and Zoom has not disclosed the actual action.
3. The Zoom Workplace client processes a request or input from that untrusted network source without correctly validating where it came from.
4. The result is an escalation of privilege with high confidentiality and integrity impact. The privilege level reached is not specified.

What remains unknown

The advisory does not specify:

• the affected component, network service, or port
• the crafted input or request format
• prerequisites beyond what the vector states
• the exact privilege escalation outcome
• whether code execution or denial of service is possible (the advisory does not claim either)

These points should stay unknown rather than be inferred from the severity score.

Exploitation status

Neither the Zoom bulletin nor the CVE record states that the vulnerability is being exploited, and no threat actor has been named. Our review of independent sources did not turn up a substantiated exploitation report. The CISA Known Exploited Vulnerabilities feed snapshot we had is dated November 9, 2026, one day before the CVE was published, so it cannot speak to status after disclosure. Absence of reporting is not evidence that exploitation is not occurring.

Patch information

The fix is a vendor binary update. No source diff or commit has been published.

Vendor advisory (ZSB 26024). Zoom published the bulletin on 11/10/2026 as revision 1.0. It lists the affected product as "Zoom Workplace for Windows before version 7.1.5" and directs users to apply "the latest updates available at https://zoom.us/download". The bulletin does not name a fixed version outright, but because the affected range stops at 7.1.5, 7.1.5 is the first release that contains the fix. NVD's record carries the same CNA range, Affected 0 < 7.1.5, under CWE 346, and links to ZSB 26024 as its only advisory and solution reference.

The release that carries the fix. Zoom's release notes list Zoom Workplace 7.1.5 as a full release dated July 20, 2026, with Windows build 7.1.5 (43453). The fixed build therefore shipped roughly four months before the bulletin, consistent with Zoom's practice of pushing fixes first and publishing advisories once most users have updated. Later builds listed in the release notes, including 7.1.8, 7.1.9, 7.2.0, 7.2.1, 7.2.2, 7.2.3 and 7.2.5 (the newest, dated October 31, 2026), are all past the boundary and include the fix.

A note on 7.0.6. The July 24, 2026 release notes entry says version 7.0.6 contains a desktop app security enhancement "also included in desktop app version 7.1.5 and later". Zoom does not tie that note to CVE-2026-108187, so treat it as context only. The bulletin's boundary remains 7.1.5.

What the fix most likely changes. The usual remediation for this weakness class is strict origin or caller validation before acting on a request, for example allow listing trusted origins and rejecting everything else. Zoom has not confirmed this, so it is an inference from CWE 346.

Verifying remediation.

• Check the Zoom Workplace version in the Windows client. It should be 7.1.5 or higher. The vendor reference build is 7.1.5 (43453), and anything newer from Zoom's download page is also fixed.
• No other packages or downstream backports are needed. The whole fix is in the client distributed by Zoom.
• The advisory provides no workaround or temporary mitigation.

Affected systems and versions

• Only the Windows client is named in the bulletin.
• Builds 7.1.8, 7.1.9, 7.2.0, 7.2.1, 7.2.2, 7.2.3 and 7.2.5 are beyond the boundary and not affected.
• No specific vulnerable configuration is described. Any Windows install below 7.1.5 falls within the stated range.

Vendor security history

Zoom maintains a public security bulletin listing with sequential identifiers, severity ratings, CVE references, and publication or update dates. The Canadian Centre for Cyber Security also recorded earlier Zoom security advisories covering multiple Windows products in July 2026 (AV26 707). This shows regular public advisory activity, though the available sources are not enough to judge Zoom's overall security performance. For this CVE, Zoom acted as the CNA and published a clear version boundary. The sources do not establish how the flaw was discovered or how quickly it was fixed relative to discovery.

References

• NVD record for CVE-2026-108187
• CVE.org record for CVE-2026-108187
• Zoom Security Bulletin ZSB 26024
• Zoom Workplace release notes (KB0061222)
• Zoom Security Bulletins index
• FIRST CVSS v3.1 Specification
• CISA Known Exploited Vulnerabilities feed
• Canadian Centre for Cyber Security, Zoom security advisory AV26 707
• About Zoom
• Zoom Fiscal 2026 Annual Report