Zoom has patched two privilege escalation flaws in Workplace for Windows, one of them rated 9.6 and neither requiring a login. The fixed build is 7.1.8.

What happened

The critical issue, CVE-2026-108186, is an unauthenticated privilege escalation rated 9.6 on the CVSS scale. A second flaw, CVE-2026-108187, is rated 8.1 and also lets a remote, unauthenticated attacker raise their privileges. Zoom published both in its security bulletin this week and says it has no indication that either has been exploited in the wild.

Zoom Workplace for Windows version 7.1.8 and later contain the fixes. Zoom has not published exploit detail, which is normal for a client-side privilege flaw before the majority of the install base has updated.

Who is affected

• Windows PCs running Zoom Workplace below 7.1.8, including personal installs on work laptops
• Estates where users install and update the client themselves rather than through a managed policy
• Contractors and remote staff who join client meetings from unmanaged machines

What to do now

Push Zoom Workplace for Windows 7.1.8 to every machine you manage, and check the version rather than assuming the client self-updated.

• Confirm the installed build through the client's About screen or your software inventory
• Use a managed update policy so the next client flaw does not depend on user action
• Check for local administrator accounts or elevated processes on machines that ran older builds
• Treat a 9.6 privilege escalation as a post-exploitation accelerator: it matters most on machines that already have an intruder

What this means for South African businesses

Zoom is one of the few applications that is on the finance director's laptop, the reception PC and the MD's phone, which makes it a reliable target for anyone who wants a foothold across an SME. The realistic risk here is not a stranger joining a meeting: it is that an attacker already on a workstation uses a local privilege flaw to reach the whole machine and the credentials stored on it. My estimate is that most South African SMEs will not patch this within the month unless someone owns client updates centrally, which is the gap worth closing now rather than after the next flaw.

Source: SecurityWeek.

Also on the blog

• N-able N-central: 33 zero-days published, hotfix fixes 7 CVEs
• WordPress core CVE-2026-119977: 240,000 attempts on the upgrade window

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.