root@ransomvault:~$ tail -f threat_intel.log

RANSOMVAULT

Topics

Patch10Threat Intelligence8Vulnerability7Ransomware3Zero-Day3Malware1Knowledge1
Subscribe to the newsletter →

Vulnerability/Patch

Zoom Patches Critical Privilege Escalation Flaws in Zoom Workplace for Windows

Darkintel Team1 min read

Zoom has released security updates for two vulnerabilities in Zoom Workplace for Windows. One of them is rated critical. Both let an unauthenticated attacker escalate privileges over the network, with no special permissions or prior access needed.

The vulnerabilities

  • CVE-2026-108186 (CVSS 9.6, Critical): An improper input validation flaw. An unauthenticated user with network access could exploit it to escalate privileges. It affects Zoom Workplace for Windows from version 7.1.0 up to, but not including, 7.1.8. (ZSB-26023)
  • CVE-2026-108187 (CVSS 8.1, High): An origin validation flaw that also lets an unauthenticated user escalate privileges over the network. It affects all versions of Zoom Workplace for Windows before 7.1.5. (ZSB-26024)

Why it matters
Zoom Workplace runs on a huge number of corporate and personal Windows machines, so it is an attractive target. Because no authentication is needed, an attacker could abuse these flaws to gain higher privileges on a system, then take further steps such as installing malware, stealing data, or moving laterally through a network.

This is also not the first serious Zoom flaw on Windows this year. In July 2026, Zoom fixed CVE-2026-53412 (CVSS 9.8), another improper input validation flaw in Zoom Workplace for Windows, which could let an unauthenticated user take over accounts.

Exploitation status
Zoom has not said that either vulnerability is being exploited in the wild. History shows, however, that attackers often reverse-engineer patches soon after release, so we recommend updating quickly.

Recommendations

  • Update Zoom Workplace for Windows to version 7.1.8 or later. This version fixes both vulnerabilities.
  • Organizations should use their endpoint management tools to find outdated Zoom installations across the fleet and push the update.
  • Turn on Zoom’s automatic updates where possible, so future fixes are applied without delay.
  • Watch endpoints for unusual privilege changes or suspicious processes linked to the Zoom client until patching is complete.

We will update this post if any active exploitation is reported.

ShareXLinkedInReddit

Newsletter

Get the latest cyber news in your inbox

Ransomware, breaches and exploited vulnerabilities, delivered by RansomVault.

Free. No spam. Unsubscribe in one click.

Latest news

How PHP2Shell Works, and Why It Gives Attackers Access Before Your Code Even Runs

Knowledge

PHP2Shell, the pair of critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, has become one of the most heavily exploited bugs of the year. It was exploited four days before PHP released patches on October 21, added to CISA’s Known Exploited Vulnerabilities catalog, and most recently used to break into Check Point Security Gateways and wipe VMware ESXi hosts. But how does it actually work? This post explains the vulnerability in plain terms, using technical research on th

FAA Grounds All U.S. Flights Over Nationwide Air Traffic Control Communications Failure

Threat Intelligence

On Friday afternoon, the Federal Aviation Administration (FAA) ordered a nationwide ground stop at every U.S. airport, citing "extraordinary circumstances" and safety concerns. U.S. Transportation Secretary Sean Duffy said a communications problem was affecting all Air Route Traffic Control Centers across the country. "FAA technicians are investigating the issue. We will provide immediate updates as we have them," Duffy wrote on X. Departing flights must stay on the ground until further noti

PHP2Shell Attacks on Check Point Gateways Deploy Data Wiper on VMware ESXi Hosts

Zero-Day / Threat Intelligence

Threat actors are exploiting vulnerable Check Point Security Gateways in a campaign that ends with data-wiping malware on VMware ESXi hosts. According to Check Point Research, the attacks began on October 30, 2026, first against Israeli organizations. A single actor ran the whole operation, from initial access to lateral movement and destruction. Background: PHP2Shell PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remo