Critical Zoom Workplace Bug Lets Attackers Hijack Windows Systems Remotely

Zoom has issued urgent patches for two severe security vulnerabilities in its Zoom Workplace software for Windows. The most critical flaw, CVE-2026-108186, carries a near-maximum CVSS score of 9.6 and allows an unauthenticated attacker on the same network to escalate privileges on a target system. A second, slightly less severe vulnerability (CVE-2026-108187, CVSS 8.1) poses a similar threat. Both flaws are categorized as improper input validation issues that can be exploited remotely without any user interaction or credentials.

For organizations using Zoom Workplace on Windows, this means that an attacker could potentially gain full administrative control over a user's workstation from the local network. The fix requires updating to version 7.1.8 or later. This incident follows another critical 9.8-rated vulnerability patched by Zoom earlier in July, highlighting a concerning pattern of severe input validation bugs in the platform. The immediate takeaway: update Zoom Workplace for Windows immediately to block this powerful attack vector.

What to do: Update Zoom Workplace for Windows to version 7.1.8 or later.