Vulnerability · critical · CVSS 9.6
Zoom fixes critical Windows flaw allowing unauthenticated privilege escalation (CVE-2026-108186)
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Zoom Workplace for Windows installations
Tier B because: Full takeover OR secrets exposed OR supply chain
Reach
Attack
Damage
Fix
Popular tool · Full takeover
What to do
- Install the latest Zoom Workplace for Windows update that Zoom has released.
The Brief
- Zoom released software updates for two security flaws affecting Zoom Workplace for Windows.
- One flaw is rated critical and could allow privilege escalation on affected systems.
- The critical flaw is tracked as CVE-2026-108186 with a CVSS score of 9.6.
Why it matters
Developers and IT teams running Zoom Workplace for Windows should update, since the critical flaw could let an attacker gain higher privileges on affected machines.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Zoom Workplace for Windows is enterprise collaboration software that IT teams deploy and manage. |
| No | Core infrastructure | A single vendor's collaboration client is not software nearly every engineering team runs as infrastructure. |
| Yes | Popular tool | Zoom Workplace is a widely used collaboration platform across many organizations. |
| No | Exploited in the wild | The Hacker News reports only the flaws and released updates; no observed attacks are mentioned. |
| No | Public exploit | The Hacker News reports no published exploit code or proof-of-concept. |
| No | Remote, no login | CVSSCVSS: CVE-2026-108186 AV:N/PR:N/UI:R |
| Yes | Full takeover | CVSSCVE-2026-108186: CVSS rates confidentiality and integrity impact high |
| No | Secrets exposed | The Hacker News reports no stolen credentials, tokens, or data exposure. |
| No | Supply chain | The Hacker News describes a vulnerability, not compromised packages, updates, or build pipelines. |
| No | No fix yet | The Hacker News says Zoom has released software updates addressing the flaws. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-108186 ↗CVSS 9.6 critical AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
- Exploited
- Not in CISA’s exploited catalog
- EPSS
- <1% chance of exploitation in the next 30 days · higher than 36% of all CVEs
- Weakness
- CWE-20
Timeline
Full coverage · 2 sources
First seen · 2 sources · Full story page · How tiers are decided