Zoom has released updates for two security flaws in Zoom Workplace for Windows, The Hacker News reported on 11 November. Zoom's bulletin describes one flaw as improper input validation, meaning the app does not properly check data it receives. Zoom says a person with no account could use it over the network to gain higher privileges. The bulletin covers versions from 7.1.0 up to, but not including, 7.1.8. The Hacker News lists that range under CVE-2026-108186, with a severity score of 9.6. It also lists CVE-2026-108187, scored 8.1, an origin validation flaw in versions before 7.1.5.
Several things remain open. Zoom's bulletin gives no technical detail on how an attack would work. Its scoring code marks user interaction as required, but the bulletin does not say what that action is. The Hacker News said Zoom makes no mention of either flaw being exploited in the wild. The outlet also noted that Zoom fixed a similar flaw in July, CVE-2026-53412, which scored 9.8.
Teams that run or manage Windows PCs should check which Zoom Workplace version is installed. Versions 7.1.8 and later sit outside both ranges listed. Zoom tells users to apply the latest update from its download page. A flaw that needs no login and works over a network is worth fixing early, even without reports of attacks.