Covered by 2 outlets — first reported by The Hacker News, Nov 11, 16:12 UTC
Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation
MentionsMicrosoftMicrosoft Windows
Summary
Zoom has released software updates for two security flaws in Zoom Workplace for Windows. The more serious one, CVE-2026-108186, is rated 9.6 in severity and stems from improper input validation; it could let an unauthenticated attacker gain higher privileges on an affected system. Coverage says that exploiting either of the two flaws could give attackers elevated access, and does not report any attacks using them.
AI summary by the SecurityTabs newsroom, checked against The Hacker News, Security Affairs. Read the outlets below for the full story.
Continue reading
2 outlets, in the order they reported it.
The Hacker NewsFirst report
Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation
Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems.
Security Affairs
Zoom Fixes Critical Windows Vulnerability Allowing Privilege Escalation
Zoom fixes two Windows Workplace flaws, including a critical bug that could let unauthenticated attackers remotely escalate privileges. Zoom has released security updates to fix two vulnerabilities in Zoom Workplace for Windows.
Explained
The technology and terms in this story. Learn more
- AttackPrivilege escalationGoing from limited access to more powerful access, such as from a normal user to administrator.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.