Executive Summary
CVE-2026-108186 was published to the National Vulnerability Database on November 10, 2026. It is an improper input validation flaw in Zoom Workplace for Windows. Per the NVD description, it "may allow an unauthenticated user to conduct an escalation of privilege via network access."
CVSS Score: 9.6 (Critical)
At the time of writing, the public record is thin: the NVD entry carries the description and score only. We have not seen exploitation reports or proof-of-concept code, and the exact affected and fixed version numbers were not available in the sources we could reach. Check Zoom's security bulletin for the authoritative version list.
Vulnerability Overview
| Field | Detail |
|---|---|
| CVE ID | CVE-2026-108186 |
| Product | Zoom Workplace for Windows |
| Weakness | Improper input validation |
| Impact | Escalation of privilege |
| Attack vector | Network |
| Authentication | None required |
| CVSS | 9.6 (Critical) |
| Published | 2026-11-10 |
A network-reachable, unauthenticated privilege escalation in a widely deployed desktop collaboration client is a high-value target. Zoom Workplace is installed on a large share of corporate Windows endpoints, so even without confirmed exploitation, the exposure is broad.
Recommended Actions
- Update Zoom Workplace for Windows to the latest release through your software deployment tooling (Intune, SCCM, RMM) and confirm the installed version against Zoom's bulletin.
- Inventory endpoints running Zoom Workplace so you can verify patch coverage rather than relying on auto-update.
- Restrict inbound network exposure of workstations: host firewalls should block unsolicited inbound connections to user endpoints.
- Monitor for unexpected child processes or privilege changes originating from the Zoom process.
- Watch for updates: re-check the NVD entry and Zoom's bulletin as vendor details and any exploitation reports emerge.