CVE-2026-108186
CVSS 9.6 CRITICAL: improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of… EPSS 0.4% (36th percentile).
Vulnerabilities · 1 day ago
NCSC-NL says Zoom patched two vulnerabilities in Zoom Workplace for Windows, one scored 9.6 on the Common Vulnerability Scoring System (CVSS).
The client mishandles checks on where information comes from and whether input is valid, letting an attacker who can reach it over a network gain higher privileges without signing in. That could affect the Windows system’s integrity, not just a Zoom session.
For organizations running the Windows client, the exposure is on endpoints, not Zoom’s wider service. The advisory provides no evidence of exploitation or fixed-version details, so it does not establish whether any system was previously accessed.
CVSS 9.6 CRITICAL: improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of… EPSS 0.4% (36th percentile).
CVSS 8.1 HIGH: origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of… EPSS 0.2% (9th percentile).
4 sources covering this story
Kwetsbaarheden verholpen in Zoom Workplace
Zoom heeft kwetsbaarheden verholpen in Zoom Workplace voor Windows.
Vulnerabilità in prodotti Zoom
Zoom ha rilasciato aggiornamenti di sicurezza per sanare due vulnerabilità, una con gravità “critica” e una con gravità “alta”, nel prodotto Zoom Workplace, piattaforma per la comunicazione e la collaborazione.
Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation
Zoom patches two Workplace for Windows flaws that could let unauthenticated remote attackers escalate privileges, including a critical bug.
Asus, Zoom Release Security Patches
Attackers could exploit them for command execution, memory overwrites, and privilege escalation.
Part of the PlainSec briefing for 2026-11-14