Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5783 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Zoom Workplace Spawning Script Interpreter — CVE-2026-108186/CVE-2026-108187 Exploitation Phase

Detects Zoom Workplace for Windows (Zoom.exe) spawning cmd, PowerShell, WScript, CScript or MSHTA via Sysmon process creation. The Zoom client has no legitimate need to launch interpreters, so this is a behaviour-first indicator of client-side code execution after exploitation of CVE-2026-108186 (CWE-20) or CVE-2026-108187 (CWE-346). Zoom reports no in-the-wild exploitation and the exploit trigger is not public, so this is proactive coverage.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1203, T1204, T1059
• Data sources: sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
• Severity: high
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (ParentImage="*\\Zoom.exe" OR ParentImage="*\\Zoom_launcher.exe") (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(User) as users by Computer ParentImage Image
| convert ctime(first_seen) ctime(last_seen)
| eval detection="TL-2026-5783 Zoom Workplace spawning script interpreter (CVE-2026-108186 / CVE-2026-108187 post-exploit behaviour)"

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("Zoom.exe", "Zoom_launcher.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
| order by Timestamp desc

Sigma

title: Zoom Workplace Windows Client Spawning Script Interpreter
id: 5b1e7a52-3c0d-4f0a-9a11-5783a0000001
status: experimental
description: Detects the Zoom desktop client spawning cmd, PowerShell, WScript, CScript or MSHTA, which is not normal client behaviour and may indicate exploitation of CVE-2026-108186 or CVE-2026-108187
references:
    - https://www.zoom.com/en/trust/security-bulletin/zsb-26023/
    - https://www.zoom.com/en/trust/security-bulletin/zsb-26024/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-108186
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.execution
    - attack.t1203
    - attack.t1204
    - attack.t1059
    - attack.initial-access
    - attack.t1190
    - cve.2026.108186
    - cve.2026.108187
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\Zoom.exe'
            - '\Zoom_launcher.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
    condition: selection_parent and selection_child
falsepositives:
    - IT automation or Zoom plugin hooks launching helper scripts
    - Custom Zoom integrations that call cmd.exe
level: high

Known false positives:

• IT automation or Zoom plugin hooks launching helper scripts
• Software packaging tools that wrap Zoom updates in cmd.exe

Tuning notes: Replace index=sysmon with your Sysmon index. Exclude known-good command lines from managed deployment tooling and keep the parent list aligned to your Zoom install (Zoom.exe, Zoom_launcher.exe). Prioritise hits from endpoints on versions earlier than 7.1.8.

• 🔒 Zoom Workplace Spawning LOLBin Proxy Execution — CVE-2026-108186/CVE-2026-108187 Exploitation Phase · unlock with TL Creds
• 🔒 Zoom Workplace Child Under Different Account Than Parent — Privilege Escalation · unlock with TL Creds
• 🔒 Zoom-Spawned Process Making External Connections — C2 and Tool Download · unlock with TL Creds
• 🔒 Zoom Workplace Unexpected Child Process — CVE-2026-108186/CVE-2026-108187 Exploitation Phase · unlock with TL Creds
• 🔒 Zoom Workplace Spawning Persistence Mechanism — Post-Exploitation · unlock with TL Creds
• 🔒 Zoom Workplace Process Accessing LSASS — Credential Access · unlock with TL Creds
• 🔒 Zoom Workplace Child Process at SYSTEM Integrity — Privilege Escalation · unlock with TL Creds
• 🔒 Zoom Workplace Dropping Executable or Script to Staging Path — Payload Staging · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5783.

Sample indicators (3 of 8)

• URL: hxxps://www[.]zoom[.]com/en/trust/security-bulletin/zsb-26023/
• URL: hxxps://www[.]zoom[.]com/en/trust/security-bulletin/zsb-26024/
• URL: hxxps://zoom[.]us/download

Defanged, TLP:CLEAR. Full set of 8 indicators: unlock with TL Creds.

Technical analysis

Zoom reports no in-the-wild exploitation, and CISA's SSVC assessment for CVE-2026-108186 lists exploitation as none; users should update to the latest release.

Zoom published security bulletins ZSB-26023 and ZSB-26024 on 2026-11-10 (Revision 1.0) covering two flaws in Zoom Workplace for Windows.

CVE-2026-108186 (ZSB-26023) is an improper input validation vulnerability (NVD maps it to CWE-20) affecting Zoom Workplace for Windows starting with 7.1.0 and before 7.1.8. Zoom scored it CVSS 3.1 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H): network-reachable, low complexity, no privileges required, user interaction required, scope changed, and high impact to confidentiality, integrity and availability. Zoom credits its own Zoom Offensive Security team. The bulletin does not state a fixed version explicitly; because the affected range ends before 7.1.8, 7.1.8 is the implied fixed release and users are directed to zoom.us/download. CISA's SSVC (v2.0.3) entry in NVD records Exploitation: none, Automatable: no, Technical Impact: total.

CVE-2026-108187 (ZSB-26024) is an origin validation error affecting Zoom Workplace for Windows before 7.1.5, scored CVSS 3.1 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). Both bulletins describe the result as an unauthenticated escalation of privilege over the network. It is credited to external researcher shmoul. The bulletin does not give a CWE ID; the weakness name corresponds to CWE-346 (Origin Validation Error).

The published sources contain no exploit mechanics, proof-of-concept code, threat actor attribution, or indicators of compromise. Neither CVE is described as exploited in the wild by Zoom or The Hacker News, and no CISA KEV listing was found. Both CVSS vectors require user interaction (UI:R), so exploitation is likely to depend on a victim interacting with attacker-controlled content or a session, but the sources do not describe the trigger.

Context: Zoom Workplace for Windows has had a run of critical flaws in 2026. CVE-2026-53412 (CVSS 9.8, improper input validation, allowing account takeover by an unauthenticated network user) was fixed in July 2026 under ZSB-26014. Separate annotation-related flaws in Zoom clients (CVE-2026-53413 to CVE-2026-53416, reported publicly as 'Zoomsday' in August 2026) were fixed in Zoom Workplace 7.1.5 and 7.0.6; these are distinct from the two CVEs here, and press reports of a researcher-published proof of concept relate to that earlier set, not to CVE-2026-108186 or CVE-2026-108187. Defenders should treat the Zoom client as an internet-facing, frequently targeted application and prioritize fleet-wide patching and version inventory.

MITRE ATT&CK techniques by tactic:

Initial Access

T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution; T1204 User Execution

Credential Access

T1212 Exploitation for Credential Access

Remediation

Patches

• ZSB-26023: Zoom Workplace for Windows 7.1.8 or later (implied from affected range 7.1.0 to before 7.1.8)
• ZSB-26024: Zoom Workplace for Windows 7.1.5 or later (implied from affected range before 7.1.5)

Immediate actions

• Update Zoom Workplace for Windows to the latest release from zoom.us/download (7.1.8 or later closes CVE-2026-108186; 7.1.5 or later closes CVE-2026-108187)
• Inventory Zoom Workplace for Windows installations and identify endpoints on versions before 7.1.8
• Hunt for unexpected child processes or privilege changes originating from the Zoom client process on Windows endpoints

Workarounds

• No vendor workaround published; limit use of the desktop client to updated versions and restrict participation in untrusted meetings until patched

Longer-term hardening

• Enforce managed, automatic updating for Zoom clients through endpoint management
• Monitor Zoom security bulletins (zoom.com/en/trust/security-bulletin) and NVD/CISA KEV for these CVEs
• Deploy EDR with behavioral detection for exploitation of collaboration clients

Affected and fixed versions

• Zoom — Zoom Workplace for Windows (CVE-2026-108186)
  Vulnerable versions: 7.1.0 up to but not including 7.1.8
  Fixed in: 7.1.8 (implied by the bulletin)
• Zoom — Zoom Workplace for Windows (CVE-2026-108187)
  Vulnerable versions: all versions before 7.1.5
  Fixed in: 7.1.5 or later (implied by the bulletin)

Timeline

• 2026-07-16 Zoom fixes CVE-2026-53412 (CVSS 9.8, improper input validation, account takeover) in Zoom Workplace for Windows under ZSB-26014; no real-world exploitation reported.
• 2026-08-12 Malwarebytes reports separate Zoom client annotation-parser memory-safety flaws ('Zoomsday', CVE-2026-53413 to CVE-2026-53415, ZSB-26017), fixed in Zoom Workplace 7.1.5 and 7.0.6; Researchers rated them Critical, Zoom rated them High. Distinct from this threat's CVEs.
• 2026-11-10 CVE-2026-108186 published in NVD with the Zoom-supplied CVSS 3.1 vector and CWE-20; status Awaiting Analysis.
• 2026-11-10 Zoom publishes ZSB-26024 (CVE-2026-108187, CVSS 8.1, origin validation error, affects versions before 7.1.5), Revision 1.0, credited to external researcher shmoul.
• 2026-11-10 Zoom publishes ZSB-26023 (CVE-2026-108186, CVSS 9.6, improper input validation, affects Zoom Workplace for Windows 7.1.0 to before 7.1.8), Revision 1.0, credited to Zoom Offensive Security.
• 2026-11-11 The Hacker News reports both flaws and notes Zoom does not mention exploitation in the wild; NVD record updated with CISA SSVC data (Exploitation: none, Automatable: no, Technical Impact: total).

Sources cited

• NVD: CVE-2026-108186 NVD (NIST) · Advisory · 2026-11-10
• CIS Advisory: A Vulnerability in Zoom Clients Could Allow for Remote Code Execution (related, distinct CVEs) cisecurity.org · Advisory
• Zoom Security Bulletin ZSB-26023 (CVE-2026-108186) zoom.com · Vendor report · 2026-11-10
• Zoom Security Bulletin ZSB-26024 (CVE-2026-108187) zoom.com · Vendor report · 2026-11-10
• Malwarebytes: 'Zoomsday' flaws could let one Zoom participant attack another (related, distinct CVEs) malwarebytes.com · Blog · 2026-08-12
• The Hacker News: Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation The Hacker News · News · 2026-11-11
• The Hacker News: Zoom patches critical Windows flaw (CVE-2026-53412, CVSS 9.8) The Hacker News · News · 2026-07-16

More in vulnerability

• Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)
• Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA Missing Authentication (CVE-2026-121683); Citrix XenServer and Ivanti Sentry/EPMM Patches
• Git Fixes 6 Vulnerabilities Enabling Code Execution via Cloned Repositories (CVE-2026-111760 et al.)
• CVE-2024-0244 – Unauthenticated Heap Buffer Overflow in Canon MF753Cdw Printer (Fax Job Handling, /wsd/print)
• Unpatched and end-of-support software on Windows endpoints exposes KEV-listed vulnerabilities (Acronis TRU telemetry; CVE-2023-38831, CVE-2026-59265)

Related coverage of this activity

• Zoom ZSB-26014 account takeover