Is your Zoom Workplace for Windows exposed to CVE-2026-108186?
Zoom published ZSB-26023 on 10 November 2026 for CVE-2026-108186, a Critical improper input validation flaw in Zoom Workplace for Windows (CVSS 9.6). It needs user interaction (UI:R): a user has to take some action, and Zoom does not say what that action is. It may let an unauthenticated user escalate privileges over the network. Update to 7.1.8 or later.
Zoom's bulletin does not mention exploitation. Not in CISA KEV
Zoom's bulletin ZSB-26023 does not mention exploitation, and we do not treat that silence as a statement that Zoom has no evidence of attacks. CVE-2026-108186 was not in CISA's Known Exploited Vulnerabilities catalogue when we rechecked at 18:19 GMT on 10 November 2026. That catalogue (2026.11.09) was released on 9 November 2026 at 19:54 UTC, before this disclosure, so it predates the CVE and does not list it. Recheck KEV. The flaw needs user interaction (UI:R): a user has to take some action, and Zoom does not say what that action is. Update Windows endpoints to Zoom Workplace 7.1.8 or later now.
By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 10 November 2026, 18:30 GMT.
At a Glance
Based on Zoom bulletin ZSB-26023, the official CVE record and CISA as of 10 November 2026. Last updated 10 November 2026, 18:30 GMT.
Critical, CVSS 9.6
Zoom rates it Critical. Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. A user has to take some action (UI:R), and Zoom does not say what that action is.
No exploitation mentioned
Zoom's bulletin does not mention exploitation. We do not treat that silence as Zoom having no evidence. Not in CISA KEV (catalogue 2026.11.09, which predates this CVE; rechecked 18:19 GMT).
Windows 7.1.0 to before 7.1.8
Zoom Workplace for Windows starting on version 7.1.0 and before version 7.1.8. Windows only.
7.1.8 or later
Zoom: apply the latest updates at zoom.us/download, which means 7.1.8 or later for this flaw.
Zoom's CVE record lists datePublic for CVE-2026-108186.
Zoom publishes ZSB-26023 revision 1.0 (dated 11/10/2026) and rates the issue Critical, CVSS 9.6.
Zoom publishes the official CVE record. Catalogue 2026.11.09 of CISA KEV does not list it.
Update Zoom Workplace for Windows to 7.1.8 or later, and find endpoints still on 7.1.0 to 7.1.7.
Affected and fixed versions
| CVE | CVSS | Product | What Zoom says | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2026-108186 | 9.6 Critical | Zoom Workplace for Windows | Improper Input Validation (CWE-20). Zoom: may allow an unauthenticated user to conduct an escalation of privilege via network access. Needs user interaction (UI:R): a user has to take some action, and Zoom does not say what that action is. | Starting on version 7.1.0 and before version 7.1.8 (Zoom bulletin wording). Windows only. | 7.1.8 or later, via the latest updates at zoom.us/download |
Affected versions follow Zoom's bulletin wording (starting on version 7.1.0 and before version 7.1.8). The official CVE record lists affected version 7.1 less than 7.1.8, on Windows. Versions before 7.1.0 are outside CVE-2026-108186; they still sit in ZSB-26024's range (Windows before 7.1.5). The checker reports those as OUT OF RANGE and says to update anyway. 7.1.5 is not the fix for CVE-2026-108186; 7.1.5 to 7.1.7 are still affected. The fix is 7.1.8 or later from zoom.us/download. The 9.6 score is Zoom's; the NVD API listed the CVE as Awaiting Analysis when we checked at 18:08 GMT on 10 November 2026 and had not given its own score.
Same-day High issue (not this page)
Zoom also published ZSB-26024 for CVE-2026-108187 the same day, an Origin Validation Error rated High (CVSS 8.1) in Zoom Workplace for Windows before version 7.1.5, and 7.1.8 also sits above that fix line. This pack has no hunts for it.
What to Do in the Next 24 Hours
Proactive on the left. Reactive on the right. Zoom's advice and our advice are labelled separately.
Update and inventory
- Zoom: update to the latest Zoom Workplace for Windows (7.1.8 or later) from zoom.us/download.
- Our advice: use RMM or Intune to find Windows endpoints still on 7.1.0 to 7.1.7, and push 7.1.8 or later.
- Zoom's documentation: MSI installs have AutoUpdate disabled by default, and the Check for Updates button is also removed (Zoom KB0057974). Our advice: turn AutoUpdate on where you can, or keep pushing 7.1.8 or later yourself with your MSI, RMM or Intune deploy for machine-wide installs.
- Our advice: check per-user installs under %AppData%\Zoom, which are often missed by machine-wide MSI patching, and inventory every Windows Zoom Workplace install you run for clients.
Hunt and contain
- Our advice: look for unexpected child processes of Zoom.exe, especially shells or LOLBins. Zoom has published no IOCs.
- Our advice: look for new local admin accounts or privilege changes on hosts that had a vulnerable build.
- Our advice: if anything looks off, isolate the host and collect EDR telemetry.
- Our advice: then update to 7.1.8 or later and rotate the user's credentials.
Proactive: Update Windows Endpoints
Zoom's fix first, then our advice for finding every install.
Update to 7.1.8 or later
Zoom: apply the latest updates available at zoom.us/download. For CVE-2026-108186, that means Zoom Workplace for Windows 7.1.8 or later. 7.1.5 is not the fix; 7.1.5 to 7.1.7 are still affected. See Zoom bulletin ZSB-26023.
Find endpoints still on 7.1.0 to 7.1.7
Our advice: use RMM or Intune to find Windows endpoints still on Zoom Workplace 7.1.0 to 7.1.7, and push 7.1.8 or later.
Turn on Zoom auto-update
Zoom's documentation: MSI installs have AutoUpdate disabled by default, and the Check for Updates button is also removed (Zoom KB0057974). Our advice: turn AutoUpdate on where you can, or keep pushing 7.1.8 or later yourself with your MSI, RMM or Intune deploy for machine-wide installs.
Check per-user installs
Our advice: per-user installs under %AppData%\Zoom are often missed by machine-wide MSI patching. Include those paths when you inventory the estate.
Inventory every Windows install
Our advice: list every Zoom Workplace for Windows install you run, for yourself and for clients, with its version. Anything still on 7.1.0 to 7.1.7 should be updated and, if you have cause, hunted.
Free Detection Pack
Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Check versions offline and hunt for signs of misuse. Everything is read-only.
check-zoom.sh
Read-only offline checker. It compares the Zoom Workplace version you give it, or a CSV inventory, against Zoom's affected range for CVE-2026-108186: starting on version 7.1.0 and before version 7.1.8, Windows only. It never contacts Zoom or an endpoint.
bash check-zoom.sh --version 7.1.7 --scope user --name ws-01
# Whole estate, from an inventory (name,platform,version,scope)
bash check-zoom.sh --inventory zoom-inventory.csvCheck-Zoom.ps1
The same checks in PowerShell 7, with identical output and exit codes. It also runs under PowerShell on Linux.
pwsh -File Check-Zoom.ps1 -Inventory zoom-inventory.csvKQL and Sigma
11 KQL hunts for Microsoft Sentinel and Defender (Q1, Q1b, Q1c, Q2, Q2b, Q3, Q3b, Q4, Q5, Q5b and Q6): Zoom inventory and version verdicts, per-user installs under %AppData%\Zoom, unexpected child processes of Zoom.exe (shells or LOLBins), elevated children, new local accounts or group changes on hosts that ran a vulnerable build, and executables written by Zoom.exe then run. 3 Sigma rules cover the shell or LOLBin children, elevated children, and files written by Zoom.exe; they are in the full pack. Q3 to Q6 are our own patterns. Zoom has published no IOCs. None of the KQL has been run against a live tenant yet. Q1 and Q1b use an unverified Defender software name match.
Verdicts
- PATCHEDWindows, Zoom Workplace 7.1.8 or later.
- VULNERABLEWindows, 7.1.0 to 7.1.7 (Zoom's affected range for this CVE).
- OUT OF RANGEWindows, below 7.1.0. Outside CVE-2026-108186. These versions still sit in ZSB-26024's range (Windows before 7.1.5). The checker reports them as OUT OF RANGE and says to update anyway.
- UNKNOWNNot Windows, no platform, no version, or a version the checker cannot read.
Exit codes
| Code | Meaning |
|---|---|
| 0 | All PATCHED |
| 1 | Any VULNERABLE |
| 2 | Any OUT OF RANGE, none vulnerable |
| 3 | Any UNKNOWN, none vulnerable or out of range |
| 4 | Usage or read error |
Inventory mode exits with the worst row. MSPs can use the exit code in RMM or scheduled jobs.
Know the limits
- Both checkers are read-only and offline. They only compare version strings or a CSV you give them, send no network traffic, write nothing and contain no exploit payloads.
- Zoom has published no indicators of compromise, so the pack contains none. Q3 to Q6 are our own patterns for what can follow an escalation of privilege. They do not detect the flaw itself.
- None of the KQL has been run against a live tenant. Q1 and Q1b have not had Defender's exact Zoom Workplace software name confirmed, so they match "zoom" in the vendor or name; tighten that filter. Q4 assumes Zoom.exe normally runs at Medium integrity, which we have not verified. Q5 has not had the GroupName field confirmed.
- 7.1.5 is not the fix for CVE-2026-108186; 7.1.5 to 7.1.7 are still affected. The fix is 7.1.8 or later from https://zoom.us/download.
What is in the pack
| File | What it does |
|---|---|
| check-zoom.sh | Offline checker for Linux and macOS (bash) |
| Check-Zoom.ps1 | The same checker in PowerShell 7 |
| KQL (11 hunts) | Microsoft Sentinel and Defender hunts Q1 to Q6, including Q1b, Q1c, Q2b, Q3b and Q5b |
| Sigma (3 rules) | Shell or LOLBin children, elevated children, and files written by Zoom.exe, plus Kusto conversions (in the full pack) |
| tests/ | Fixtures, bash and Pester tests and a sandboxed no-network run |
| README.md | Verified facts, Zoom advice versus ours, limits and usage (in the full pack) |
Reactive: How to Hunt (Our Advice)
Zoom has published no indicators of compromise. These hunts are CybaVerse advice. CybaOps can run them across your estate or your clients'.
Unexpected child processes of Zoom.exe
Our advice: look for unexpected child processes of Zoom.exe, especially shells or LOLBins, on hosts that had a vulnerable build.
New local admin accounts or privilege changes
Our advice: look for new local admin accounts or privilege changes on hosts that had a vulnerable Zoom Workplace for Windows build (starting on version 7.1.0 and before version 7.1.8).
If anything looks off
Our advice: isolate the host, collect EDR telemetry, then update to 7.1.8 or later and rotate the user's credentials.
If you find signs of misuse (our advice)
- Isolate the host. Keep it powered and keep the EDR telemetry and logs.
- Update Zoom Workplace for Windows to 7.1.8 or later from zoom.us/download.
- Rotate the user's credentials, and review local admin membership and privilege changes.
- Hunt neighbouring Windows endpoints that were still on 7.1.0 to 7.1.7.
Updated does not mean clean
Updating stops new use of this flaw. It does not undo privilege changes, new local admin accounts or child processes already started. Hunt the period before you updated.
Zoom Workplace for Windows CVE-2026-108186 FAQ
Short answers based on Zoom bulletin ZSB-26023, the official CVE record and CISA as of 10 November 2026.
What is CVE-2026-108186?
It is an improper input validation flaw in Zoom Workplace for Windows, published by Zoom on 10 November 2026 as bulletin ZSB-26023, revision 1.0 (dated 11/10/2026). Zoom's description is: Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access. The official CVE record uses the same wording, lists CWE-20, and records datePublic as 10 November 2026 at 13:00 UTC and datePublished as 10 November 2026 at 15:32 UTC.
What is the severity, and does it need user interaction?
Zoom rates it Critical, with a CVSS 3.1 score of 9.6 and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. The official CVE record uses the same score and marks user interaction as REQUIRED. It needs user interaction (UI:R): a user has to take some action, and Zoom does not say what that action is. We do not guess what the action is. We do not add a severity label of our own, and we do not invent an NVD score. The NVD API listed the CVE as Awaiting Analysis when we checked at 18:08 GMT on 10 November 2026, and had not given its own score.
Which versions and platforms are affected?
Zoom's affected products list is Zoom Workplace for Windows starting on version 7.1.0 and before version 7.1.8. We follow that bulletin wording. The official CVE record lists the product as Zoom Workplace, the platform as Windows, and the affected versions as 7.1 less than 7.1.8. Versions before 7.1.0 are outside CVE-2026-108186; they still sit in ZSB-26024's range (Windows before 7.1.5). The checker reports those as OUT OF RANGE and says to update anyway. 7.1.5 is not the fix for CVE-2026-108186; 7.1.5 to 7.1.7 are still affected. Footer links on Zoom's website to Android or iOS apps are not affected-product listings, so this page treats the issue as Windows-only.
How do we fix it?
Zoom says users can help keep themselves secure by applying the latest updates available at https://zoom.us/download. For CVE-2026-108186, that means Zoom Workplace for Windows 7.1.8 or later. 7.1.5 is not the fix; 7.1.5 to 7.1.7 are still affected.
Is it being exploited, or in CISA KEV?
Zoom's bulletin does not mention exploitation, and we do not treat that silence as a statement that Zoom has no evidence of attacks. CVE-2026-108186 was not in CISA's Known Exploited Vulnerabilities catalogue when we rechecked at 18:19 GMT on 10 November 2026. That catalogue (2026.11.09) was released on 9 November 2026 at 19:54 UTC, before this disclosure, so it predates the CVE and does not list it. Recheck KEV. A KEV due date would apply only to US federal agencies. Update now regardless.
Did Zoom publish indicators of compromise?
No. Zoom has published no indicators of compromise. Q3 to Q6 are our hunts. None of the KQL has been run against a live tenant.
What about CVE-2026-108187, published the same day?
Zoom also published bulletin ZSB-26024 the same day for CVE-2026-108187, an Origin Validation Error in Zoom Workplace for Windows before version 7.1.5, rated High (CVSS 8.1). That issue is not Critical, so it does not have its own page here, and this pack has no hunts for it. Zoom Workplace for Windows 7.1.8 also sits above that fix line. 7.1.5 is not the fix for CVE-2026-108186; 7.1.5 to 7.1.7 are still affected.
Who reported it?
Zoom's bulletin for CVE-2026-108186 credits Zoom Offensive Security, which is Zoom itself. It is fair to say Zoom reported it.
Who is this relevant to?
MSPs and IT teams that deploy Zoom Workplace for Windows, including per-user installs under %AppData%\Zoom, which are often missed by machine-wide MSI patching. The affected range is starting on version 7.1.0 and before version 7.1.8. Endpoints still on 7.1.0 to 7.1.7 should be updated to 7.1.8 or later.
Protect Your Windows Endpoints, and Your Clients'
CybaOps monitors your servers, endpoints and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.
Sources
- Zoom: ZSB-26023, Zoom Workplace for Windows - Improper Input Validation (revision 1.0, 10 November 2026)
- Zoom: Download centre (latest Zoom Workplace updates)
- Zoom: Troubleshooting missing Check for Updates option (KB0057974)
- CVE record: CVE-2026-108186 (published by Zoom, 10 November 2026)
- NVD: CVE-2026-108186
- Zoom: ZSB-26024, Zoom Workplace for Windows - Origin Validation Error (revision 1.0, 10 November 2026)
- CVE record: CVE-2026-108187 (published by Zoom, 10 November 2026)
- CISA: Known Exploited Vulnerabilities catalogue (rechecked 10 November 2026, 18:19 GMT; catalogue 2026.11.09, released 9 November 2026 at 19:54 UTC)
Related threat guides: Barracuda CVE-2026-116606 and CVE-2026-111560 and ConnectWise cloud backup compromise. All threat guides.