Which Zoom Workplace versions does CVE-2026-108186 affect?

Two Zoom bulletins published on November 10 split the Windows client into four version bands. Only 7.1.8 and later sits outside both.

CVE-2026-108186 affects Zoom Workplace for Windows from version 7.1.0 up to but not including 7.1.8, and Zoom rates it Critical at CVSS 9.6. A second flaw, CVE-2026-108187 (CVSS 8.1), affects versions before 7.1.5. Zoom published both bulletins on November 10, 2026 and tells users to install the latest release from zoom.us/download.

How serious is CVE-2026-108186?

Zoom rates it Critical, 9.6 out of 10 on the CVSS 3.1 scale. The bulletin describes an input validation bug in the Windows client that may let an unauthenticated user escalate privileges over the network.

The vector string reads network access, low complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity and availability. User interaction means the victim has to do something, and the bulletin does not say what. Scope changed means the damage can reach beyond the Zoom app itself. Zoom Offensive Security, the company's own team, reported the bug.

Is CVE-2026-108187 a separate flaw, and which versions does it hit?

Yes, it is a separate flaw with its own bulletin, ZSB-26024, covering an origin validation flaw in the Windows build of Zoom Workplace before version 7.1.5. Zoom rates it High at CVSS 8.1, and a researcher known as shmoul reported it. Like the first flaw, it may let an unauthenticated user escalate privileges over the network.

Put the two affected ranges together and a PC falls into one of four bands:

Installed Zoom Workplace for Windows	CVE-2026-108186 (9.6)	CVE-2026-108187 (8.1)
Before 7.1.0	Not affected	Affected
7.1.0 up to before 7.1.5	Affected	Affected
7.1.5 up to before 7.1.8	Affected	Not affected
7.1.8 or later	Not affected	Not affected

The table applies the ranges as the bulletins write them. Neither bulletin names a fixed version, and ZSB-26024 says only to apply the latest updates. SecurityOnline reports 7.1.8 as the fix for both.

Is anyone exploiting the Zoom Workplace flaws?

Zoom's bulletins do not say, and Zoom states on its bulletin index that it does not provide additional details about a vulnerability. SecurityOnline reports no confirmed exploitation and says CISA's Known Exploited Vulnerabilities list has neither CVE. That is a third-party check, so confirm it against the catalog before you rely on it. Both bulletins show only their first revision, dated November 10.

How do you check which Zoom Workplace version a PC is running?

On a Windows desktop, click your profile picture at the top right, choose Help, then About Zoom Workplace, according to Issoh's guide to the client's versions. Zoom's newest Windows build is 7.2.5 (build 51704), released October 31, 2026. Version 7.1.9, released September 24 on Zoom's slow track, and every 7.2.x release sit above 7.1.8, so both fall outside the two ranges.

What should IT teams do about the Zoom Workplace flaws today?

Start with an inventory, because the answer depends on the exact build on each PC.

List every Windows PC running Zoom Workplace and flag any version below 7.1.8. That covers both CVEs.
Push the latest build, 7.2.5 at the time of writing, through your deployment tool instead of waiting for users to update.
Do not stop at 7.1.5. It closes CVE-2026-108187 and leaves CVE-2026-108186 open.
Look for copies installed outside your managed catalogue, including per-user installs on shared PCs.
Read the scope narrowly. These two bulletins list only Zoom Workplace for Windows, so check the Zoom bulletin index for the Rooms, VDI and SDK versions you run.

This story reflects Zoom's bulletins as read on November 14, 2026. It will be updated if Zoom revises either one. Our SonicWall SAML check shows the same version-by-version approach for a different product.