---
id: "CVE-2026-108186"
page: "https://infrastack.ai/live/CVE-2026-108186"
kind: "vulnerability"
aliases: ["CVE-2026-108186"]
title: "Zoom Workplace for Windows: input flaw lets a network attacker gain higher privileges"
severity: "critical"
cvss: 9.6
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Zoom Workplace", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Zoom Workplace for Windows", "fixed": ["7.1.8"], "affected": ">= 7.1.0, < 7.1.8", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["vendor", "windows", "zoom", "zoom-workplace"]
not_affected_if: ["macos-linux-mobile", "version-7.1.8-or-later", "version-below-7.1.0"]
published_at: "2026-11-10T16:17:14+00:00"
first_seen_at: "2026-11-10T16:22:32+00:00"
updated_at: "2026-11-10T16:23:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108186", "first_seen_at": "2026-11-10T16:22:32+00:00"}, {"source": "analyst", "url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-26023", "first_seen_at": "2026-11-10T16:23:47+00:00", "cites": ["https://www.zoom.com/en/trust/security-bulletin/ZSB-26023"]}]
exploit_sources: []
---

# Zoom Workplace for Windows: input flaw lets a network attacker gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-108186 (this .md is for agents)

Zoom bulletin ZSB-26023 (11/10/2026): improper input validation in Zoom Workplace for Windows 7.1.0 up to before 7.1.8 may let an unauthenticated attacker escalate privileges over the network (CVSS 9.6, user interaction required). Zoom credits its own Offensive Security team and says to apply the latest updates.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Zoom Workplace affected range not listed fixed no fixed version listed
- vendor:Zoom Workplace for Windows affected >= 7.1.0, < 7.1.8 fixed 7.1.8

## How to check

In Zoom Workplace on Windows, open profile > Settings > About (or Help > About) and read the version. Affected if it is 7.1.0 up to but not including 7.1.8.

## Fix

Update Zoom Workplace for Windows to the latest version (zoom.us/download); versions 7.1.0 to before 7.1.8 are affected, so 7.1.8 or later. Zoom's bulletin names no specific fixed build.

## Timeline

- 2026-11-10T16:22:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108186
- 2026-11-10T16:23:47+00:00 analyst https://www.zoom.com/en/trust/security-bulletin/ZSB-26023 — Read Zoom ZSB-26023: affected Zoom Workplace for Windows >= 7.1.0 and < 7.1.8; CVSS 9.6 AV:N/PR:N/UI:R/S:C. Vendor gives no fixed version beyond 'apply latest updates'; 7.1.8 is the first version outside the range (inferred, fix not marked verified). No exploitation or PoC found.

## Documents

- [advisory] ZSB-26023 Zoom Workplace for Windows - Improper Input Validation https://www.zoom.com/en/trust/security-bulletin/ZSB-26023

## From the sources

Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_