Zoom Issues Critical Security Update: Windows Users Urged to Patch 9.6-Severity Flaw

Two newly disclosed Zoom vulnerabilities could allow attackers to gain elevated privileges on affected Windows computers.

Zoom has released security updates addressing two vulnerabilities in its Workplace application for Windows, including a critical flaw rated 9.6 out of 10. The vulnerabilities could allow unauthenticated attackers to escalate privileges through network access, potentially putting affected business and personal devices at risk.

The company disclosed the issues on Nov. 10, making this a timely update for organizations that rely on Zoom for everyday communication. Zoom has not reported active exploitation of either vulnerability in its security advisories, but Windows users and IT administrators should check their installed versions and apply the latest fixes.

Zoom security flaws could allow attackers to gain elevated privileges

According to Zoom's security advisory, the more serious vulnerability, CVE-2026-108186, stems from improper input validation in Zoom Workplace for Windows.

Improper input validation occurs when software fails to adequately check information it receives or processes. Depending on the affected component, attackers may exploit the weakness to trigger unintended behavior.

Zoom says the vulnerability could allow an unauthenticated attacker to escalate privileges through network access. In practical terms, privilege escalation can allow an attacker to gain access or permissions beyond those normally available.

The vulnerability carries a critical CVSS score of 9.6, with high potential impacts on confidentiality, integrity, and availability. Its assessment also indicates that exploitation requires user interaction, although attackers do not need existing privileges.

Zoom has not publicly detailed what action would be necessary to trigger exploitation.

The vulnerability affects Zoom Workplace for Windows versions 7.1.0 through 7.1.7. Version 7.1.8 and later fall outside the affected range.

A second Zoom vulnerability carries an 8.1 severity rating

Zoom also disclosed CVE-2026-108187, a separate high-severity vulnerability involving an origin validation error.

According to the company's second security bulletin, this flaw could also allow an unauthenticated attacker to escalate privileges through network access.

Origin validation is a security mechanism used to determine whether requests or information originate from an acceptable source. Weaknesses in these checks can undermine the boundaries software relies on to distinguish trusted and untrusted activity.

The vulnerability carries a CVSS score of 8.1 and affects Zoom Workplace for Windows versions earlier than 7.1.5.

Like the critical vulnerability CVE-2026-108187, it requires user interaction according to its CVSS assessment. Zoom has not specified what action would constitute exploitation.

Here is how the two vulnerabilities compare:

Both vulnerabilities involve privilege escalation, although they stem from different underlying weaknesses.

Zoom has not disclosed a complete technical exploitation chain for either issue. The company's advisories also do not report confirmed attacks exploiting these vulnerabilities.

Why the Zoom vulnerabilities matter for businesses

Zoom is widely used for workplace meetings, collaboration, and communication, making vulnerabilities in its desktop software relevant to organizations of different sizes.

The concern is particularly significant for businesses that manage large numbers of Windows endpoints. A vulnerable collaboration application can create an additional security exposure, especially when employees regularly use the software throughout the workday.

Privilege-escalation vulnerabilities deserve attention because they can allow attackers to move beyond their initial access level. Depending on the vulnerability and surrounding conditions, elevated permissions could increase an attacker's ability to access sensitive information or interfere with system operations.

However, the potential impact should not be confused with evidence of an actual compromise. Zoom has not reported active exploitation of either newly disclosed flaw in its security advisories.

The latest disclosures also follow earlier security problems involving Zoom's Windows software. In July, eSecurity Planet reported that Zoom patched a critical account takeover vulnerability that could allow unauthenticated attackers to compromise user accounts.

Another August report examined how researchers used AI to uncover a Zoom zero-click exploit chain. Those incidents involved different vulnerabilities, but they demonstrate why widely deployed collaboration tools require ongoing security attention.

More broadly, privilege escalation remains a recurring problem across enterprise software. eSecurity Planet previously examined Windows Defender's ShieldBreak vulnerability, which raised concerns about attackers gaining SYSTEM-level permissions on affected Windows devices.

How to update Zoom Workplace for Windows

Zoom recommends installing the latest available software updates to address the vulnerabilities.

For Windows users, the immediate priority is determining which version of Zoom Workplace is installed.

To check and update Zoom:

1. Open the Zoom Workplace desktop application on Windows.
2. Select your profile picture and navigate to Help > About Zoom Workplace to check the installed version.
3. Return to the profile menu and select Check for Updates, if that option is available.
4. Install the latest available update and restart the application if prompted.
5. Confirm that Zoom Workplace is running the latest available version approved by your organization.

Users can also obtain the latest installer through Zoom's official download center.

For organizations using centrally managed Zoom installations, the update process may differ. Some deployments installed through enterprise software management tools do not expose the standard in-app update option.

IT administrators should verify installed versions across managed Windows devices and deploy updated software through their organization's approved management tools.

Security teams should also consider the following precautions:

• Prioritize affected Windows devices: Identify Zoom Workplace installations running vulnerable versions.
• Verify successful deployment: Confirm that updated versions are installed rather than relying solely on deployment status.
• Review endpoint security monitoring: Investigate suspicious activity involving unexpected privilege changes or unusual application behavior.
• Maintain an application inventory: Track collaboration software alongside operating systems and other routinely patched applications.

These steps can help organizations reduce exposure while maintaining visibility into their endpoint security posture.

No confirmed exploitation reported, but patching remains important

Zoom's Nov. 10 advisories do not report active exploitation of either vulnerability.

The company has also not publicly disclosed detailed attack procedures or evidence that attackers have successfully exploited the flaws to compromise customer devices.

That uncertainty matters. A critical vulnerability rating indicates potentially serious consequences under the conditions reflected in its assessment, but it does not establish that exploitation is occurring.

For organizations managing Windows endpoints, the practical response is straightforward: identify affected Zoom Workplace installations, deploy the latest updates, and verify that vulnerable versions are no longer running.

The disclosures are another reminder that routine business applications can introduce significant security risks when critical updates are delayed.

Related reading: For more on urgent software security updates, see how Google patched an actively exploited Chrome zero-day and what organizations should do to protect vulnerable devices.