Two security flaws in Zoom Workplace on Windows let an attacker gain higher privileges on a victim's computer, and both have now been patched.
The two flaws
- CVE-2026-108186 — caused by improper validation of user-supplied input. CVSS 9.6. Affects versions 7.1.0 up to but not including 7.1.8.
- CVE-2026-108187 — caused by weak verification of the legitimacy of a data source. CVSS 8.1. Affects versions before 7.1.5.
Both can be exploited over a network, without any authorisation or special access. That phrase is the reason these scored where they did: an attacker does not need your password, does not need to already be on your machine, and does not need you to run anything.
What to do
Zoom has released updated versions fixing both, and advises Windows users to install the latest Zoom Workplace build immediately. Open Zoom, click your profile picture, and choose Check for Updates. Anything at 7.1.8 or later clears both flaws.
If your organisation manages Zoom centrally, the version your staff are on is whatever IT last pushed — which on many Bangladeshi office networks is the version installed when the machine was set up.
Why publication makes the risk worse, not better
It feels backwards, but a patched and published flaw is often more dangerous for a week than an unpublished one.
Before disclosure, an attacker needs to find the bug. After disclosure, the advisory describes the component, the versions and the failure mode, and the patch itself can be compared against the previous release to locate the exact change. That narrows the work from research to engineering.
So the gap between a fix being available and a fix being installed is the window that actually gets exploited — and on desktop software that people never close, that window is long.
Context: this is not the first this year
In July, Zoom patched a separate Windows flaw — CVE-2026-53412, CVSS 9.8 — that could allow account takeover without authorisation.
Three critical-range flaws in one product in one year is worth noting, though it says less about Zoom's engineering than it might appear: widely used software is examined more closely, and a vendor that publishes CVEs promptly produces a longer public list than one that does not.
What is not known
Zoom has not said whether either flaw has been used in real attacks, and the report does not name who found them. Treat the absence of confirmed exploitation as unknown rather than as reassurance — vendors routinely cannot tell, and the answer often arrives weeks later.
What the two scores actually mean
CVSS runs from 0 to 10, and the gap between 9.6 and 8.1 is wider than it looks. Both of these are remotely reachable without authorisation, so the difference comes from what follows a successful attack and how reliably it works. A 9.6 is in the band where organisations are expected to patch out of cycle rather than waiting for the next maintenance window.
The version check that matters most
Note that the two flaws have different fixed versions — 7.1.8 for the first, 7.1.5 for the second. Updating to 7.1.5 would clear one and leave the other, which is exactly the kind of partial patch that looks like a completed task on a checklist. Anything from 7.1.8 upward closes both, so that is the only number worth remembering.
