Privilege Escalation Vulnerability in Zoom Workplace for Windows (CVE-2026-108187)
Zoom has released a security bulletin addressing a high-severity vulnerability in Zoom Workplace for Windows, tracked as CVE-2026-108187. The vulnerability is classified as an Origin Validation Error (CWE-346) and carries a CVSS v3.1 severity score of 8.1. Under specific user interaction scenarios, an unauthenticated attacker on the network can exploit this flaw to execute actions with escalated privileges on the affected Windows host. Zoom has resolved this vulnerability in...
Description
Technical context and vulnerability details
Zoom Workplace for Windows provides unified video conferencing, chat, whiteboard, and collaborative workspace features for desktop enterprise environments.
The vulnerability identified under CVE-2026-108187 stems from insufficient verification of data origins (CWE-346) within inter-process or external URL/protocol handling routines of the desktop application. An attacker can craft malicious links, meeting invites, or network requests that trick the application into processing external instructions as trusted internal actions.
When a user interacts with the crafted payload, the Zoom Workplace client fails to validate the origin of the originating request properly. This flaw enables the attacker to trigger unintended application workflows and elevate execution privileges within the context of the running local session.
The vulnerability was identified and reported to Zoom through their coordinated vulnerability disclosure program. Zoom has released version 7.1.8 of Zoom Workplace for Windows to mitigate CVE-2026-108187 along with related security enhancements.
Potential Risks & Impact
Potential consequences upon exploitation
- Escalation of privilege on the local Windows system;
- Unauthorized execution of privileged application routines or system actions;
- Tampering with local Zoom configuration files and session caches;
- Potential leakage of sensitive meeting data, tokens, or personal identifiers.
Affected systems
Products, components and targeted versions
- Zoom Workplace for Windows versions prior to 7.1.8 (including all 7.1.x builds prior to 7.1.5);
- Zoom Workplace VDI client for Windows prior to patched maintenance releases.
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Upgrade Zoom Workplace for Windows to version 7.1.8 or higher immediately;
- Organizations using enterprise software management tools (Microsoft Intune, SCCM, Group Policy) should enforce automated client updates across all Windows endpoints;
- Educate enterprise end-users to avoid clicking unverified meeting links, chat attachments, or calendar invites from unknown sources;
- Verify that endpoint detection and response (EDR) solutions monitor unexpected child processes spawned by desktop collaboration software.
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.