Zoom fixes critical Windows flaw CVE-2026-108186

Zoom has released a critical security update for Zoom Workplace for Windows after assigning CVE-2026-108186 a CVSS score of 9.6. According to Zoom's security bulletin, improper input validation could let an unauthenticated user escalate privileges through network access, although user interaction is required. Versions beginning with 7.1.0 and earlier than 7.1.8 are affected; version 7.1.8 is the fixed boundary. Organizations should update Windows clients to 7.1.8 or later, confirm the rollout completed, and prioritize devices exposed to untrusted network content. Security teams should also review endpoint telemetry for unexpected privileged processes associated with Zoom activity. The NVD record reflects Zoom's CNA score and affected version range. As of November 13, 2026, the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, so the critical rating should not be treated as proof of active exploitation.