CVE-2026-108186
CVSS 9.6 CRITICAL: improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of… EPSS 0.4% (36th percentile).
Vulnerabilities & Exploits
NCSC-NL says Zoom patched two vulnerabilities in Zoom Workplace for Windows, one scored 9.6 on the Common Vulnerability Scoring System (CVSS).
The client mishandles checks on where information comes from and whether input is valid, letting an attacker who can reach it over a network gain higher privileges without signing in. That could affect the Windows system’s integrity, not just a Zoom session.
For organizations running the Windows client, the exposure is on endpoints, not Zoom’s wider service. The advisory provides no evidence of exploitation or fixed-version details, so it does not establish whether any system was previously accessed.
4 sources · 1 day ago
CVSS 9.6 CRITICAL: improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of… EPSS 0.4% (36th percentile).
CVSS 8.1 HIGH: origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of… EPSS 0.2% (9th percentile).
NCSC-NL Advisories
Kwetsbaarheden verholpen in Zoom Workplace
Zoom heeft kwetsbaarheden verholpen in Zoom Workplace voor Windows.
originalCSIRT Italia / ACN
Vulnerabilità in prodotti Zoom
Zoom ha rilasciato aggiornamenti di sicurezza per sanare due vulnerabilità, una con gravità “critica” e una con gravità “alta”, nel prodotto Zoom Workplace, piattaforma per la comunicazione e la collaborazione.
originalThe Hacker News
Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation
Zoom patches two Workplace for Windows flaws that could let unauthenticated remote attackers escalate privileges, including a critical bug.
originalPart of the PlainSec briefing for 2026-11-14
Every edition of this story: Zoom Workplace flaws could grant Windows host privileges