# Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation

> Two vulnerabilities in Zoom Workplace for Windows allow an unauthenticated attacker with network access to escalate privileges: CVE-2026-108186 (CVSS 9.6, improper input validation, versions 7.1.0 up to but not including 7.1.8) and CVE-2026-108187 (CVSS 8.1, origin validation error, versions before 7.1.5). Zoom reports no in-the-wild exploitation, and CISA's SSVC assessment for CVE-2026-108186 lists exploitation as none; users should update to the latest release.

- **Published:** 2026-11-11T17:17:59Z
- **Last reviewed:** 2026-11-11T17:17:59Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5783
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5783.png
- **ID:** TL-2026-5783
- **Severity:** CRITICAL (CVSS 9.6)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 8 (3 shown free below)
- **CVEs:** CVE-2026-108186, CVE-2026-108187, CVE-2026-53412

## Description

Zoom published security bulletins ZSB-26023 and ZSB-26024 on 2026-11-10 (Revision 1.0) covering two flaws in Zoom Workplace for Windows.

CVE-2026-108186 (ZSB-26023) is an improper input validation vulnerability (NVD maps it to CWE-20) affecting Zoom Workplace for Windows starting with 7.1.0 and before 7.1.8. Zoom scored it CVSS 3.1 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H): network-reachable, low complexity, no privileges required, user interaction required, scope changed, and high impact to confidentiality, integrity and availability. Zoom credits its own Zoom Offensive Security team. The bulletin does not state a fixed version explicitly; because the affected range ends before 7.1.8, 7.1.8 is the implied fixed release and users are directed to zoom.us/download. CISA's SSVC (v2.0.3) entry in NVD records Exploitation: none, Automatable: no, Technical Impact: total.

CVE-2026-108187 (ZSB-26024) is an origin validation error affecting Zoom Workplace for Windows before 7.1.5, scored CVSS 3.1 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). Both bulletins describe the result as an unauthenticated escalation of privilege over the network. It is credited to external researcher shmoul. The bulletin does not give a CWE ID; the weakness name corresponds to CWE-346 (Origin Validation Error).

The published sources contain no exploit mechanics, proof-of-concept code, threat actor attribution, or indicators of compromise. Neither CVE is described as exploited in the wild by Zoom or The Hacker News, and no CISA KEV listing was found. Both CVSS vectors require user interaction (UI:R), so exploitation is likely to depend on a victim interacting with attacker-controlled content or a session, but the sources do not describe the trigger.

Context: Zoom Workplace for Windows has had a run of critical flaws in 2026. CVE-2026-53412 (CVSS 9.8, improper input validation, allowing account takeover by an unauthenticated network user) was fixed in July 2026 under ZSB-26014. Separate annotation-related flaws in Zoom clients (CVE-2026-53413 to CVE-2026-53416, reported publicly as 'Zoomsday' in August 2026) were fixed in Zoom Workplace 7.1.5 and 7.0.6; these are distinct from the two CVEs here, and press reports of a researcher-published proof of concept relate to that earlier set, not to CVE-2026-108186 or CVE-2026-108187. Defenders should treat the Zoom client as an internet-facing, frequently targeted application and prioritize fleet-wide patching and version inventory.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1212 Exploitation for Credential Access

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Zoom Workplace Spawning Script Interpreter — CVE-2026-108186/CVE-2026-108187 Exploitation Phase** (`TL-2026-5783-SPL-001`)

Detects Zoom Workplace for Windows (Zoom.exe) spawning cmd, PowerShell, WScript, CScript or MSHTA via Sysmon process creation. The Zoom client has no legitimate need to launch interpreters, so this is a behaviour-first indicator of client-side code execution after exploitation of CVE-2026-108186 (CWE-20) or CVE-2026-108187 (CWE-346). Zoom reports no in-the-wild exploitation and the exploit trigger is not public, so this is proactive coverage.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1203, T1204, T1059
- **Data sources:** sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (ParentImage="*\\Zoom.exe" OR ParentImage="*\\Zoom_launcher.exe") (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(User) as users by Computer ParentImage Image
| convert ctime(first_seen) ctime(last_seen)
| eval detection="TL-2026-5783 Zoom Workplace spawning script interpreter (CVE-2026-108186 / CVE-2026-108187 post-exploit behaviour)"
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("Zoom.exe", "Zoom_launcher.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
| order by Timestamp desc
```

### Sigma

```yaml
title: Zoom Workplace Windows Client Spawning Script Interpreter
id: 5b1e7a52-3c0d-4f0a-9a11-5783a0000001
status: experimental
description: Detects the Zoom desktop client spawning cmd, PowerShell, WScript, CScript or MSHTA, which is not normal client behaviour and may indicate exploitation of CVE-2026-108186 or CVE-2026-108187
references:
    - https://www.zoom.com/en/trust/security-bulletin/zsb-26023/
    - https://www.zoom.com/en/trust/security-bulletin/zsb-26024/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-108186
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.execution
    - attack.t1203
    - attack.t1204
    - attack.t1059
    - attack.initial-access
    - attack.t1190
    - cve.2026.108186
    - cve.2026.108187
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\Zoom.exe'
            - '\Zoom_launcher.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
    condition: selection_parent and selection_child
falsepositives:
    - IT automation or Zoom plugin hooks launching helper scripts
    - Custom Zoom integrations that call cmd.exe
level: high

```

**Known false positives:**

- IT automation or Zoom plugin hooks launching helper scripts
- Software packaging tools that wrap Zoom updates in cmd.exe

**Tuning notes:** Replace index=sysmon with your Sysmon index. Exclude known-good command lines from managed deployment tooling and keep the parent list aligned to your Zoom install (Zoom.exe, Zoom_launcher.exe). Prioritise hits from endpoints on versions earlier than 7.1.8.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Zoom Workplace Spawning LOLBin Proxy Execution — CVE-2026-108186/CVE-2026-108187 Exploitation Phase (locked: unlock with TL Creds)
- Zoom Workplace Child Under Different Account Than Parent — Privilege Escalation (locked: unlock with TL Creds)
- Zoom-Spawned Process Making External Connections — C2 and Tool Download (locked: unlock with TL Creds)
- Zoom Workplace Unexpected Child Process — CVE-2026-108186/CVE-2026-108187 Exploitation Phase (locked: unlock with TL Creds)
- Zoom Workplace Spawning Persistence Mechanism — Post-Exploitation (locked: unlock with TL Creds)
- Zoom Workplace Process Accessing LSASS — Credential Access (locked: unlock with TL Creds)
- Zoom Workplace Child Process at SYSTEM Integrity — Privilege Escalation (locked: unlock with TL Creds)
- Zoom Workplace Dropping Executable or Script to Staging Path — Payload Staging (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 8)

Defanged, TLP:CLEAR.

- URL: `hxxps://www[.]zoom[.]com/en/trust/security-bulletin/zsb-26023/`
- URL: `hxxps://www[.]zoom[.]com/en/trust/security-bulletin/zsb-26024/`
- URL: `hxxps://zoom[.]us/download`

Full set of 8 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Zoom Security Bulletin ZSB-26023 (CVE-2026-108186)](https://www.zoom.com/en/trust/security-bulletin/zsb-26023/)
- [Zoom Security Bulletin ZSB-26024 (CVE-2026-108187)](https://www.zoom.com/en/trust/security-bulletin/zsb-26024/)
- [NVD: CVE-2026-108186](https://nvd.nist.gov/vuln/detail/CVE-2026-108186)
- [The Hacker News: Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation](https://thehackernews.com/2026/11/critical-zoom-workplace-flaw-could.html)
- [The Hacker News: Zoom patches critical Windows flaw (CVE-2026-53412, CVSS 9.8)](https://thehackernews.com/2026/07/zoom-patches-critical-windows-flaw-that.html)
- [Malwarebytes: 'Zoomsday' flaws could let one Zoom participant attack another (related, distinct CVEs)](https://www.malwarebytes.com/blog/bugs/2026/08/zoomsday-flaws-could-let-one-zoom-participant-attack-another)
- [CIS Advisory: A Vulnerability in Zoom Clients Could Allow for Remote Code Execution (related, distinct CVEs)](https://www.cisecurity.org/advisory/a-vulnerability-in-zoom-clients-could-allow-for-remote-code-execution_2026-081)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5783