Zoom Workplace vulnerability CVE-2026-108186: are your Windows computers really up to date?
On November 10, 2026, Zoom published two security bulletins for its Windows desktop app, Zoom Workplace. The more serious one, CVE-2026-108186, is rated 9.6 out of 10: an unauthenticated person could, over the network, gain more rights than they should have. The good news: the fix has existed since late August. The bad news: in many small businesses, some computers never received it, and the inventory says otherwise.
This Zoom Workplace vulnerability isn’t reported as exploited for now. That makes this the right time to clean up, before attackers study the fix.
Zoom Workplace vulnerability: what Zoom announced
9.6/10
CVE-2026-108186: improper input validation, privilege escalation without authentication (bulletin ZSB-26023)
8.1/10
CVE-2026-108187: origin validation error, same possible effect (bulletin ZSB-26024)
7.1.8
Version that fixes both flaws, released August 31, 2026 (build 46825)
0
Known exploitation so far, according to Zoom
Zoom gives no technical details on how the flaws can be exploited. According to the analysis published by RFF, the attack scenario requires a user to take an action (for example, clicking or joining something). Zoom says nothing more: the official advice is simply to move to the latest version.
Which versions are affected?
The trap: your inventory may be lying
Two details make a computer look up to date when it isn’t.
Where old copies of Zoom hide
Programs and Features
Windows shows "7.1.43453" for version 7.1.5: the patch number disappears. A report that compares 43453 to 8 thinks the computer is fixed.
Misleading
C:Program FilesZoombinZoom.exe
The file’s full version (for example 7.1.5.43453) is the only one to trust for a machine-wide install.
Reliable
%APPDATA%Zoombin
An employee who installs Zoom themselves, without admin rights, gets a copy in their own profile.
Often missed
User registry (ZoomUMX)
That copy registers in the user’s registry, not the machine’s. An inventory tool that only reads the machine part never sees it.
Invisible
Check a computer in 30 seconds
Your IT lead can run this PowerShell command (as administrator) on a computer. It lists every copy of Zoom, installed for the machine or inside a user profile, with its full version:
// PowerShell: find every copy of Zoom.exe
What each line does
- 1The two locations of a machine-wide installation.
- 2The location of an installation made by an employee, for every profile on the computer.
- 3Shows the path and the file’s full version. Anything below 7.1.8 must be updated.
Read-only command: it changes nothing on the computer.
The update plan, in order
Update from inside Zoom
Profile picture > Check for Updates
For one or two computers, this is the simplest. Close and reopen Zoom, then check the version number.
Deploy the current version machine-wide
Zoom Workplace MSI installer
For a fleet, deploy the latest version through your management tool. According to RFF’s tests, the recent machine-wide install also removed the old copy installed in the signed-in user’s profile.
Check again with the command
Zoom.exe, full version
Don’t trust the Programs and Features report: rerun the command on a sample of computers, including those of employees who were away during the rollout.
Prevent do-it-yourself installs
Zoom automatic update policy
Turn on automatic updates and limit software installs by employees, so an old copy doesn’t come back inside a profile.
📅 Why talk about it now if the fix dates from August?
Zoom released version 7.1.8 on August 31 labelled "security enhancements", with no details. The November 10 bulletins finally reveal how serious it was. Computers that haven’t kept up with updates since the summer have therefore been exposed for weeks. In July, another Zoom for Windows flaw (CVE-2026-53412, rated 9.8) already called for the same care.
Same logic as for Office: an update only counts once it’s applied and checked. See our article on the Outlook zero-day fixed this week, and ask your IT provider how it checks its own tools, as explained in our article on the N-able N-central vulnerability.
How NeoTech can help
For our managed IT services clients, apps such as Zoom, Teams and browsers are inventoried by their real version, including copies installed in user profiles, and updated automatically. Automated 24/7 monitoring with on-call technician intervention flags computers that fall behind. We also adjust your software installation rules in Microsoft 365.
Book your free cyber check
In 30 minutes, we check with you which Zoom versions are really running on your computers, where forgotten copies hide and how to keep them from coming back.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- Zoom — Security Bulletins (ZSB-26023 and ZSB-26024, Nov. 10, 2026)
- Zoom — Release notes for the Zoom Workplace app (version 7.1.8, build 46825)
- The Hacker News — Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation
- SecurityWeek — Asus, Zoom Release Security Patches
- RFF — Zoom Workplace CVE-2026-108186: Windows clients before 7.1.8 need an update (build numbers and per-user installs)
Photo: Vitaly Gariev, Pexels (Pexels licence).