Zoom published security bulletins ZSB-26023 and ZSB-26024, dated 10 November 2026, for Zoom Workplace for Windows. ZSB-26023 covers CVE-2026-108186, which Zoom rates Critical (CVSS 3.1 9.6): "Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access." ZSB-26024 covers CVE-2026-108187, which Zoom rates High (CVSS 3.1 8.1): "Origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access." Zoom's published vectors for both require user interaction (UI:R).
Both bulletins give the same remediation: "Users can help keep themselves secure by applying the latest updates available at https://zoom.us/download." For CVE-2026-108186, Zoom lists "Zoom Workplace for Windows starting on version 7.1.0 and before version 7.1.8." For CVE-2026-108187, Zoom lists "Zoom Workplace for Windows before version 7.1.5," with no lower bound. Version 7.1.8 and later sit outside both affected ranges; 7.1.5 through 7.1.7 sit outside the CVE-2026-108187 range but inside the CVE-2026-108186 range.
Zoom's bulletin pages do not discuss exploitation. CVE-2026-108186 and CVE-2026-108187 are not in CISA KEV as of catalogVersion 2026.11.10, checked 11 November 2026 at 19:21 Asia/Jerusalem UTC+2. This post makes no exploitation claim.
Technical Information
CVE-2026-108186 (ZSB-26023). Zoom rates it Critical, CVSS 3.1 9.6, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H: reachable over the network with no privileges required, but requiring user interaction (UI:R), with changed scope (S:C). Zoom's CVE record lists CWE-20 (Improper Input Validation). The bulletin credits "Zoom Offensive Security."
CVE-2026-108187 (ZSB-26024). Zoom rates it High, CVSS 3.1 8.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N: also requiring user interaction (UI:R), with unchanged scope and no availability impact. Zoom's CVE record lists CWE-346 (Origin Validation Error). The bulletin credits "shmoul."
What the bulletins do not say. Neither bulletin describes the exploit path, what the required user interaction is, or which privilege level an attacker could reach. This post does not fill those gaps. NVD republishes Zoom's vectors as metric type Secondary and lists both records as Awaiting Analysis.
CVE record encoding. For CVE-2026-108186, Zoom's CVE record encodes "Zoom Workplace" on Windows as affected from version 7.1 up to but not including 7.1.8. The bulletin's wording, "starting on version 7.1.0 and before version 7.1.8," is more specific, and this post follows it. For CVE-2026-108187, the record encodes 0 up to but not including 7.1.5, matching the bulletin.
Affected Product Versions
From Zoom's bulletins. Zoom does not list macOS, Linux, mobile, Zoom Rooms or VDI clients on these bulletins, and this post does not extend the scope.
| Product | Bulletin / CVE | Affected, as Zoom states | Outside that range |
|---|---|---|---|
| Zoom Workplace for Windows | ZSB-26023 / CVE-2026-108186 | starting on version 7.1.0 and before version 7.1.8 | 7.1.8 and later |
| Zoom Workplace for Windows | ZSB-26024 / CVE-2026-108187 | before version 7.1.5 (no lower bound stated) | 7.1.5 and later |
Zoom's remediation is the latest update from https://zoom.us/download. When confirming a fleet, a Windows client on 7.1.8 or later is outside both affected ranges. Each bulletin is revision 1.0, dated 11/10/2026, "Initial publication," and Zoom's index showed no later revision at the 19:21 recheck.
Exploitation Status
Zoom's ZSB-26023 and ZSB-26024 pages do not discuss exploitation, customer impact or proof-of-concept code. CISA-ADP's SSVC entries on both CVE records set Exploitation to "none" and Automatable to "no"; that is CISA-ADP's assessment, not a KEV listing. Neither CVE was in CISA KEV at the 19:21 check. This post makes no exploitation claim.
Workaround and Mitigation
Neither bulletin lists a workaround or compensating control. Zoom's guidance is to apply the latest updates available at https://zoom.us/download. A Windows client below 7.1.8 remains in scope for at least CVE-2026-108186.
Indicators of Compromise
Zoom's bulletins publish no indicators of compromise or detection guidance for these CVEs, and this post does not supply any.
What to Ask Your Suppliers and MSPs Today
Zoom Workplace for Windows runs on the laptops of suppliers' and MSPs' staff, including people who work inside your environment or join your meetings. Both vectors require user interaction, and Zoom does not say what that interaction is, so staff who routinely open meeting links and invitations from outside parties are a sensible group to update first. Ask suppliers that manage Windows endpoints, or whose staff use Zoom with you, in writing:
- Whether their Windows fleets are on Zoom's latest update, confirmed as 7.1.8 or later, which is outside both affected ranges.
- How they enforce Zoom client updates, including update rings, group-policy holds or offline installers that could leave endpoints between 7.1.0 and versions before 7.1.8.
- When lagging endpoints will be updated, and how they will confirm the running client version afterwards.
If you manage the Windows client yourself, apply Zoom's latest update from the official download page first, then confirm the same points against your inventory.
If your team needs help reviewing which suppliers manage Zoom Workplace for Windows and whether those fleets are on 7.1.8 or later, Talk to an expert.
Sources
- ZSB-26023 — Zoom Workplace for Windows - Improper Input Validation, Zoom, revision 1.0 dated 11/10/2026; CVE-2026-108186, Zoom rating Critical 9.6. Rechecked 11 November 2026 at 19:21 Asia/Jerusalem UTC+2.
- ZSB-26024 — Zoom Workplace for Windows - Origin Validation Error, Zoom, revision 1.0 dated 11/10/2026; CVE-2026-108187, Zoom rating High 8.1. Rechecked 11 November 2026 at 19:21 Asia/Jerusalem UTC+2.
- Zoom Security Bulletins index, Date Published and Date Updated 11/10/2026 for both bulletins.
- CVE-2026-108186 and NVD — Zoom CNA, CVSS 3.1 9.6, CWE-20; NVD Awaiting Analysis, metric Secondary; CISA-ADP SSVC Exploitation none.
- CVE-2026-108187 and NVD — Zoom CNA, CVSS 3.1 8.1, CWE-346; NVD Awaiting Analysis, metric Secondary; CISA-ADP SSVC Exploitation none.
- CISA catalog JSON feed — catalogVersion 2026.11.10, dateReleased 2026-11-10T19:03:29Z; CVE-2026-108186 and CVE-2026-108187 are not in CISA KEV as of 11 November 2026 at 19:21 Asia/Jerusalem UTC+2.
- The Hacker News, 11 November 2026 — secondary coverage; scores and version ranges match Zoom's bulletins.
