Threat video1:00
CVE-2026-108186 Zoom Workplace Priv Esc: Detection & IOCs
Zoom Workplace for Windows flaw CVE-2026-108186 lets unauthenticated attackers escalate privileges. Get 9 detection rules, 8 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2026-108186 Zoom Workplace Priv Esc: Detection & IOCs →
Chapters
- 0:00The hookZoom fixed two Windows flaws enabling unauthenticated escalation.
- 0:05The storyZoom published two bulletins on November 10.
- 0:12Attack pathZoom for Windows has an input validation flaw.
- 0:29AttributionNo threat actor: this was defensive research.
- 0:33Indicators of compromiseNo malicious indicators were published.
- 0:39MITRE ATT&CK techniques4 ATT&CK techniques, from initial access to credential access.
- 0:44Remediation3 steps now: Update Zoom Workplace for Windows to the latest release.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Zoom fixed two Windows flaws enabling unauthenticated escalation.
0:05Zoom published two bulletins on November 10.
0:08Zoom reports no exploitation. Update now.
0:12Zoom for Windows has an input validation flaw.
0:16A second flaw is an origin validation error.
0:19Either one alone allows unauthenticated escalation.
0:23Both require user interaction.
0:25CISA lists exploitation as none.
0:29No threat actor: this was defensive research.
0:34No malicious indicators were published.
0:394 ATT&CK techniques, from initial access to credential access.
0:443 steps now: Update Zoom Workplace for Windows to the latest release.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.