Zoom Workplace for Windows 7.1.8 Fixes CVE-2026-108186 Critical Escalation of Privilege

Entenda a falha

A vulnerabilidade

Two escalation-of-privilege flaws affect Zoom Workplace for Windows. CVE-2026-108186 (CVSS 9.6, Critical, bulletin ZSB-26023) is an improper input validation bug. Its scope-changed vector means the impact can reach beyond the Zoom app. It affects versions 7.1.0 up to, but not including, 7.1.8. CVE-2026-108187 (CVSS 8.1, bulletin ZSB-26024) is an origin validation error affecting versions before 7.1.5. Both are reachable over the network without authentication, but the CVSS vectors require user interaction, and Zoom has not said what action triggers either bug. Version 7.1.8 fixes both.

Como funciona

The articles do not describe the internal mechanism in detail. For CVE-2026-108186, the Zoom bulletin says input reaching the Windows client over the network is not properly validated, which may let an unauthenticated party escalate privileges. For CVE-2026-108187, the client fails to properly validate the origin of something it receives. For both, the user must first take some action that Zoom has not disclosed.

Por que é vulnerável

According to the bulletins, the root causes are missing or insufficient validation: improper input validation in CVE-2026-108186 and an origin validation error in CVE-2026-108187. The articles do not explain why the bugs went unnoticed or what exactly the fix changes beyond moving to version 7.1.8 or later.

Como foi descoberta

Zoom Offensive Security, the vendor's own team, found CVE-2026-108186 internally. A researcher known as shmoul reported CVE-2026-108187. Zoom published both bulletins, ZSB-26023 and ZSB-26024, on November 10, 2026. The articles do not say how or when the bugs were found or reported beyond that. Zoom has reported no exploitation, and neither CVE is in CISA's Known Exploited Vulnerabilities catalog.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 14:15.