{"id":"CVE-2026-108186","kind":"vulnerability","aliases":["CVE-2026-108186"],"related":[],"title":"Zoom Workplace for Windows: input flaw lets a network attacker gain higher privileges","description":"Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.","summary":"Zoom bulletin ZSB-26023 (11/10/2026): improper input validation in Zoom Workplace for Windows 7.1.0 up to before 7.1.8 may let an unauthenticated attacker escalate privileges over the network (CVSS 9.6, user interaction required). Zoom credits its own Offensive Security team and says to apply the latest updates.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Zoom Workplace","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Zoom Workplace for Windows","fixed":["7.1.8"],"affected":">= 7.1.0, < 7.1.8","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["vendor","windows","zoom","zoom-workplace"],"not_affected_if":["macos-linux-mobile","version-7.1.8-or-later","version-below-7.1.0"],"how_to_check":"In Zoom Workplace on Windows, open profile > Settings > About (or Help > About) and read the version. Affected if it is 7.1.0 up to but not including 7.1.8.","fix":"Update Zoom Workplace for Windows to the latest version (zoom.us/download); versions 7.1.0 to before 7.1.8 are affected, so 7.1.8 or later. Zoom's bulletin names no specific fixed build.","status":"open","published_at":"2026-11-10T16:17:14+00:00","first_seen_at":"2026-11-10T16:22:32+00:00","triaged_at":"2026-11-10T16:23:15+00:00","updated_at":"2026-11-10T16:23:47+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-10T16:23:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Zoom Workplace for Windows: input flaw lets a network attacker gain higher privileges","impact":"high","summary":"Zoom Workplace for Windows does not validate some input properly, so an unauthenticated user on the network can escalate privileges on the machine. The sources rate it critical with a CVSS score of 9.6 and do not say which versions are affected or fixed.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["zoom-workplace","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated network attacker gains elevated privileges on Windows machine","analyst_note":"Confirm affected and fixed Zoom Workplace for Windows versions and whether a vendor advisory exists; the sources given only state the NVD description.","how_to_check":"- Check the installed Zoom Workplace version on Windows machines, for example in the app's About screen, and compare it with the fixed version once the vendor states it.\n- unknown","plain_action":"If you use Zoom Workplace on Windows, update it to the newest version from Zoom as soon as the update is available.","product_name":"Zoom Workplace","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000705,"input_tokens":4505,"output_tokens":508,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm affected and fixed Zoom Workplace for Windows versions and whether a vendor advisory exists; the sources given only state the NVD description.","search":"'-108186':16A,19A '-2026':15A,18A '-26023':35B '11/10/2026':36B '7.1.0':45B '7.1.8':49B '9.6':61B 'access':100C 'allow':88C 'appli':75B 'attack':10A,54B 'bulletin':33B 'conduct':93C 'credit':66B 'cve':14A,17A 'cvss':60B 'escal':55B,95C 'flaw':6A 'for':24A 'gain':11A 'higher':12A 'improp':37B,79C 'input':5A,38B,80C 'interact':63B 'latest':77B 'let':7A,51B 'may':50B,87C 'network':9A,59B,99C 'offens':69B 'privileg':13A,56B,97C 'requir':64B 'say':73B 'secur':70B 'team':71B 'unauthent':53B,90C 'updat':78B 'user':62B,91C 'valid':39B,81C 'vendor':26B 'via':98C 'window':4A,27B,44B,86C 'windows':25A 'workplac':2A,31B,42B,84C 'workplace':21A,23A 'zoom':1A,20A,22A,28B,30B,32B,41B,65B,83C 'zoom-workplac':29B 'zsb':34B","nicknames":[],"mitigations":[],"who_affected":"Windows machines running Zoom Workplace between 7.1.0 and before 7.1.8. Zoom's CVSS vector requires user interaction and no authentication. Other platforms and versions outside that range are not listed in the bulletin.","tier":"B","verified":{"products":{"at":"2026-11-10T16:23:47Z","by":"analyst","doc":"https://www.zoom.com/en/trust/security-bulletin/ZSB-26023","run_id":2464},"who_affected":{"at":"2026-11-10T16:23:47Z","by":"analyst","doc":"https://www.zoom.com/en/trust/security-bulletin/ZSB-26023","run_id":2464}},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Update Zoom Workplace on your Windows computer to the latest version: open Zoom, click your profile picture, and choose Check for Updates.","pkeys":["workplace","workplaceforwindows","zoomworkplace","zoomworkplaceforwindows"],"ptokens":["for","windows","workplace","zoom"],"labels":["critical","vendor","windows","zoom","zoomworkplace"],"campaign_type":null,"search_a":"'-108186':16A,19A '-2026':15A,18A 'attack':10A 'cve':14A,17A 'flaw':6A 'for':24A 'gain':11A 'higher':12A 'input':5A 'let':7A 'network':9A 'privileg':13A 'window':4A 'windows':25A 'workplac':2A 'workplace':21A,23A 'zoom':1A,20A,22A","search_b":"'-26023':35B '11/10/2026':36B '7.1.0':45B '7.1.8':49B '9.6':61B 'appli':75B 'attack':54B 'bulletin':33B 'credit':66B 'cvss':60B 'escal':55B 'improp':37B 'input':38B 'interact':63B 'latest':77B 'let':51B 'may':50B 'network':59B 'offens':69B 'privileg':56B 'requir':64B 'say':73B 'secur':70B 'team':71B 'unauthent':53B 'updat':78B 'user':62B 'valid':39B 'vendor':26B 'window':27B,44B 'workplac':31B,42B 'zoom':28B,30B,32B,41B,65B 'zoom-workplac':29B 'zsb':34B","search_c":"'access':100C 'allow':88C 'conduct':93C 'escal':95C 'improp':79C 'input':80C 'may':87C 'network':99C 'privileg':97C 'unauthent':90C 'user':91C 'valid':81C 'via':98C 'window':86C 'workplac':84C 'zoom':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"security@zoom.us","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108186","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108186","severity":null,"published_at":"2026-11-10T16:17:14+00:00","modified_at":"2026-11-10T16:17:14+00:00","first_seen_at":"2026-11-10T16:22:32+00:00","fetched_at":"2026-11-10T16:22:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-108186:2464","url":"https://www.zoom.com/en/trust/security-bulletin/ZSB-26023","severity":null,"published_at":"2026-11-10T16:23:47+00:00","modified_at":"2026-11-10T16:23:47+00:00","first_seen_at":"2026-11-10T16:23:47+00:00","fetched_at":"2026-11-10T16:23:47+00:00","note":"Read Zoom ZSB-26023: affected Zoom Workplace for Windows >= 7.1.0 and < 7.1.8; CVSS 9.6 AV:N/PR:N/UI:R/S:C. Vendor gives no fixed version beyond 'apply latest updates'; 7.1.8 is the first version outside the range (inferred, fix not marked verified). No exploitation or PoC found.","cites":["https://www.zoom.com/en/trust/security-bulletin/ZSB-26023"]}],"documents":[{"id":116239,"url":"https://www.zoom.com/en/trust/security-bulletin/ZSB-26023","title":"ZSB-26023 Zoom Workplace for Windows - Improper Input Validation","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}