Zoom Critical Flaw: Update Windows Apps to 7.1.8 Now

In short: On 10 November 2026, Zoom published two security bulletins for Zoom Workplace for Windows. The more serious flaw, CVE-2026-108186, is rated critical with a CVSS score of 9.6 and can allow privilege escalation over the network. Zoom says version 7.1.8 or later fixes it. Update every Windows PC that runs Zoom now.

Zoom is on almost every office laptop, often installed by employees themselves and rarely checked by IT. That is exactly why this update matters: an old Zoom client quietly sitting on dozens of PCs is easy to forget and easy to miss in a patch cycle.

What Happened

According to the Zoom Security Bulletins page, Zoom published two bulletins on 10 November 2026, both for Zoom Workplace for Windows:

• ZSB-26023, CVE-2026-108186: rated Critical. It is described as an improper input validation flaw. Security news reports put its CVSS score at 9.6 and list affected versions as 7.1.0 up to, but not including, 7.1.8.
• ZSB-26024, CVE-2026-108187: rated High. It is described as an origin validation error, with a reported CVSS score of 8.1, affecting versions before 7.1.5.

Reports from SecurityOnline and eSecurity Planet say both flaws could let an unauthenticated attacker escalate privileges over the network, and that the CVSS scoring indicates some user interaction is needed. Zoom has not publicly described what that interaction is.

As of these reports, Zoom has not said the flaws are being exploited, no public exploit code has been reported, and neither CVE was listed in the US CISA Known Exploited Vulnerabilities catalogue. That can change quickly once a patch is public, because attackers often study fixes to build exploits.

Who Is Affected

Item	Details as reported
Product	Zoom Workplace for Windows (desktop app)
Critical flaw	CVE-2026-108186, ZSB-26023, CVSS 9.6
Affected versions	7.1.0 to before 7.1.8
High flaw	CVE-2026-108187, ZSB-26024, CVSS 8.1, versions before 7.1.5
Fixed version	7.1.8 or later covers both
Exploited in the wild	Not reported at the time of writing

The bulletins name only the Windows desktop app. If you use Zoom on Mac, mobile or Zoom Rooms, keep those updated as usual, but these two bulletins do not list them.

What It Means for Indian Businesses and Departments

Privilege escalation flaws are dangerous because they let an attacker do more on a machine than a normal user can. For an office, that can mean an attacker who gets a foothold is able to install tools, turn off protection or move further into the network.

The bigger risk for many Indian SMEs and government offices is not the flaw itself but visibility. Zoom is often installed per user, outside the normal software list, so IT teams may not know how many PCs run it or which version. Organisations covered by CERT-In directions should also keep their vulnerability and patch records in order, so they can show what was fixed and when. Our guide on the patch management process explains how to make this routine.

What to Do Now

1. Find every Zoom install: use your endpoint management or asset inventory tool to list all Windows PCs with Zoom Workplace and their version numbers.
2. Update to 7.1.8 or later: push the latest version from Zoom's official download centre through your software deployment tool, or ask users to update from within the app.
3. Check versions on single PCs: in the Zoom app, open Help and then About Zoom Workplace to confirm the version.
4. Remove old or unused copies: uninstall Zoom from PCs that no longer need it, and remove outdated per-user installs.
5. Turn on automatic updates where possible: so future Zoom fixes reach users without waiting for the next patch cycle.
6. Record the change: note the date, the number of PCs updated and any exceptions in your patch register.

This is also a good moment to finish this month's Windows updates. Our note on Microsoft's November 2026 Patch Tuesday covers an Outlook zero-day that also needs attention.

Frequently Asked Questions

Is the Zoom flaw being exploited?

At the time of the reports, Zoom had not said the flaws were exploited and no public exploit had been reported. Patch now anyway, because this can change once the fix is studied.

Which Zoom version is safe?

Reports based on Zoom's bulletins say Zoom Workplace for Windows 7.1.8 or later fixes both CVE-2026-108186 and CVE-2026-108187.

Do Mac and mobile users need to act?

The two bulletins name only Zoom Workplace for Windows. Keep other Zoom apps updated as normal good practice.

How Affix Center Can Help

Affix Center runs patching, endpoint management and IT support for companies and government offices. Our managed IT services in Mumbai include software inventory, monthly patch cycles and reports you can show to auditors. If you need help finding and updating every Zoom install or setting up a proper patch routine, contact our team.

Sources: Zoom Security Bulletins (ZSB-26023 and ZSB-26024, 10 November 2026), and reports by SecurityOnline and eSecurity Planet.