# Zoom Addresses Critical Privilege Escalation Vulnerabilities in Windows Workplace Software Security updates resolve two high-severity flaws allowing unauthorized remote access to Windows systems. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-11-12 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/58b7a4e1-662c-46ea-ad31-d2246e84fd3b ## Critical Security Updates Released Zoom has issued urgent security patches for its Workplace for Windows application to address two distinct privilege escalation vulnerabilities. These flaws allow unauthenticated remote attackers to gain elevated system permissions without requiring user interaction or prior account access. Users are strongly advised to update their software immediately to mitigate these risks. ## Input Validation Flaw Details The most severe vulnerability, tracked as CVE-2026-108186, carries a critical CVSS score of 9.6. This input validation error impacts versions from 7.1.0 up to 7.1.8. By sending specially crafted messages, attackers can corrupt system memory, potentially executing unauthorized code, stealing sensitive data, or activating hardware like cameras and microphones remotely. ## Origin Validation Vulnerability Scope A second issue, CVE-2026-108187, involves an origin validation flaw with a CVSS score of 8.1. This vulnerability affects Zoom Workplace for Windows releases earlier than version 7.1.5. Like the primary flaw, it enables unauthenticated remote attackers to escalate their privileges, posing a significant threat to the security of affected Windows systems. ## Discovery and Reporting Sources The identification of these security gaps involved both internal and external efforts. The critical input validation flaw was discovered by Zoom’s internal security team, while the origin validation issue was reported by the research group known as shmoul. These collaborative efforts are essential for identifying complex memory corruption bugs before active exploitation occurs. ## Recent History of Vulnerabilities This update follows a series of security challenges for the platform throughout the summer. In July, Zoom patched CVE-2026-53412, a critical flaw with a 9.8 CVSS score that allowed account hijacking. Additionally, an August update addressed a zero-click memory corruption issue dubbed Zoomsday, which impacted all platforms including Windows, Mac, and Linux. ## Technical Impact of Exploitation Successful exploitation of these vulnerabilities enables attackers to bypass standard security controls. By leveraging memory corruption, malicious actors can execute arbitrary code on a victim's machine without the user clicking any links or downloading files. This level of control allows for persistent malware installation and unauthorized access to private meeting participant data. ## Current Threat Landscape Status Despite the severity of these vulnerabilities, Zoom has stated that they are currently unaware of any active exploitation in the wild. The company continues to monitor the situation closely while urging all users to apply the latest patches. Maintaining updated software remains the primary defense against these remote privilege escalation attack vectors. ## Proactive Security Maintenance Requirements The recurring nature of these critical flaws highlights the importance of consistent software maintenance. As Zoom continues to address memory corruption and validation errors, users must prioritize installing updates for the Windows VDI Client and Meeting SDK. Regular patching is the only effective method to close these identified identity and access gaps. ## Sources covering this story - [Security Affairs — Zoom Patches Critical Privilege Escalation Flaws in Windows Workplace](https://securityaffairs.com/202911/security/zoom-fixes-critical-windows-vulnerability-allowing-privilege-escalation.html) - [The Hacker News — Critical Zoom Workplace Flaw Enables Remote Privilege Escalation](https://thehackernews.com/2026/11/critical-zoom-workplace-flaw-could.html) --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._