Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation Ravie LakshmananNov 11, 2026Vulnerability / Software Security Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems. CVE-2026-108186 (CVSS score: 9.6) - An improper input validation vulnerability that could allow an unauthenticated user to conduct an escalation of privilege via network access. CVE-2026-108187 (CVSS score: 8.1) - An origin validation vulnerability that could allow an unauthenticated user to conduct an escalation of privilege via network access. Successful exploitation of either of the shortcomings could permit remote attackers to escalate privileges without requiring any special permissions or access. While CVE-2026-108187 affects Zoom Workplace for Windows before version 7.1.5, CVE-2026-108186 impacts versions starting from 7.1.0 and before 7.1.8. Earlier this July, the popular videoconferencing platform shipped fixes for another improper input validation flaw impacting Zoom Workplace for Windows (CVE-2026-53412, CVSS score: 9.8) that could enable an unauthenticated user to take control of accounts. Although Zoom makes no mention of the vulnerabilities being exploited in the wild, users are advised to apply the latest patches to mitigate potential threats. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Software Security, Vulnerability, Windows The Flood is Coming And The Pipes Were Already Full Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Register Free Today Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Uncover Identity Dark Matter: SACR Research Brief Eliminate the blind spots undermining your security. Download the SACR brief. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk