Zoom Workplace for Windows Privilege Escalation (CVE-2026-108186)

How Does CVE-2026-108186 Work?

Zoom identifies improper input validation as the weakness and network access as the route to the affected Windows client. It says an unauthenticated user may be able to escalate privileges, but does not publish the specific input or component involved.

The CVSS 3.1 vector marks attack complexity low, privileges required none, and user interaction required. That means the published score assumes some user action; Zoom does not describe what the user must do.

Zoom also marks scope changed and confidentiality, integrity, and availability impacts high. These are properties of the vendor's severity assessment, not evidence that a real system has been compromised.

What Is Known About Exploitation?

CISA's KEV catalog version 2026.11.10 did not list CVE-2026-108186. A catalog listing is a dated signal and does not determine what has happened outside the catalog.

The published CVSS vector describes possible impact, not observed activity. Treat the exploitation state as unknown while prioritizing affected clients for an update.

Which Zoom Workplace Versions Are Affected?

Zoom lists Zoom Workplace for Windows from version 7.1.0 up to, but not including, 7.1.8. Check the installed Windows client version and update affected installations to 7.1.8 or later through Zoom's official download channel.

The bulletin does not list macOS, Linux, or mobile clients for this CVE. Keep this version check specific to Windows rather than extending the affected range to other platforms.

A separate Zoom bulletin covers CVE-2026-108187, an origin validation error in Zoom Workplace for Windows before 7.1.5. It is a different flaw with a different affected range and CVSS 3.1 score of 8.1.

How Should Teams Prioritize the Risk?

The 9.6 Critical score reflects network access, low attack complexity, and high potential impact, with user interaction required. Brandefense Blackhole counted seven dark-chat messages mentioning CVE-2026-108186 between August 13 and November 11, 2026.

That count is a discussion signal, not proof of exploitation. Our assessment is to prioritize every Windows client in the affected version range for an update.

What Should Defenders Do?

Inventory Zoom Workplace for Windows versions and move affected 7.1.0 through 7.1.7 installations to 7.1.8 or later. Verify the installed version after deployment and include devices that update outside central software management.

As a Brandefense precaution, review client update coverage and investigate unexpected privilege changes on affected endpoints. The public bulletin does not provide a detection signature or a detailed attack sequence, so avoid claiming a CVE-specific alert is available.

Use the vulnerability management guide to track the rollout. The privilege escalation glossary explains the impact, and the patch management glossary covers routine verification.