Zoom Workplace for Windows Critical Privilege Escalation (CVE-2026-108186, CVE-2026-108187) and ASUS Router Firmware Remote File Access Vulnerabilities (CVE-2026-88707 to CVE-2026-88710) Patched

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5801 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Zoom Workplace Client Spawning Script Interpreter or LOLBin (CVE-2026-108186) - Exploitation (SPL)

Behavioural detection for Zoom Workplace for Windows (7.1.0 - 7.1.7 for CVE-2026-108186, earlier than 7.1.5 for CVE-2026-108187) or its helper processes spawning a command interpreter, script host or living-off-the-land binary. ZSB-26023 and ZSB-26024 publish no exploit signature, so this hunts the client-side execution outcome (T1203, T1059) rather than a payload pattern. A conferencing client has little legitimate reason to launch these children.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1059
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: high
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage IN ("*Zoom.exe","*CptHost.exe","*Zoom_launcher.exe","*ZoomWebviewHost.exe") Image IN ("*cmd.exe","*powershell.exe","*pwsh.exe","*wscript.exe","*cscript.exe","*mshta.exe","*rundll32.exe","*regsvr32.exe","*certutil.exe","*bitsadmin.exe")
```TL-2026-5801 CVE-2026-108186 and CVE-2026-108187 Zoom client spawning a shell or LOLBin T1203 T1059```
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(User) as users values(IntegrityLevel) as integrity_levels by host ParentImage Image
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("Zoom.exe", "CptHost.exe", "Zoom_launcher.exe", "ZoomWebviewHost.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessIntegrityLevel, FileName, ProcessCommandLine, ProcessIntegrityLevel, ReportId
| order by Timestamp desc

Sigma

title: Zoom Workplace Client Spawning Script Interpreter or LOLBin (CVE-2026-108186)
id: 7c1f4a52-3b8e-4d6a-9f21-5e0a8b3d6c14
status: experimental
description: Detects the Zoom Workplace for Windows client or its helper processes spawning a command interpreter, script host or common living-off-the-land binary. Behavioural hunt for post-exploitation of the network-reachable Zoom flaws CVE-2026-108186 and CVE-2026-108187 (ZSB-26023, ZSB-26024); no exploit signature is public.
references:
  - https://www.zoom.com/en/trust/security-bulletin/ZSB-26023/
  - https://www.zoom.com/en/trust/security-bulletin/ZSB-26024/
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
  - cve.2026.108186
  - cve.2026.108187
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Zoom.exe'
      - '\CptHost.exe'
      - '\Zoom_launcher.exe'
      - '\ZoomWebviewHost.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Zoom plugins or IT-deployed integrations that legitimately launch helper scripts
  - Zoom update or repair workflows invoking rundll32 or cmd
level: high

Known false positives:

• Zoom plugins or IT-deployed integrations that legitimately launch helper scripts
• Zoom update or repair workflows invoking rundll32 or cmd

Tuning notes: Baseline Zoom child processes for 7 days and exclude known-good command lines. Prioritise hosts still running Zoom Workplace below 7.1.8 by joining with software inventory. Adjust the index name to match your Sysmon index.

• 🔒 Zoom Workplace Client Spawning Script Interpreter or LOLBin (CVE-2026-108186) - Exploitation (KQL) · unlock with TL Creds
• 🔒 Zoom Workplace Descendant Process Running at High or SYSTEM Integrity (CVE-2026-108186 / CVE-2026-108187) - Privilege Escalation (KQL) · unlock with TL Creds
• 🔒 ASUS Router Remote File Access Service Crash, USB Mount or Root Shell (CVE-2026-88707 - CVE-2026-88710) - Edge Device (KQL) · unlock with TL Creds
• 🔒 Zoom Workplace Client Spawning Script Interpreter or LOLBin (CVE-2026-108186) - Exploitation (Sigma) · unlock with TL Creds
• 🔒 Zoom Workplace Descendant Process Running at High or SYSTEM Integrity (CVE-2026-108186 / CVE-2026-108187) - Privilege Escalation (Sigma) · unlock with TL Creds
• 🔒 ASUS Router Remote File Access Service Crash, USB Mount or Root Shell (CVE-2026-88707 - CVE-2026-88710) - Edge Device (Sigma) · unlock with TL Creds
• 🔒 Zoom Workplace Descendant Process Running at High or SYSTEM Integrity (CVE-2026-108186 / CVE-2026-108187) - Privilege Escalation (SPL) · unlock with TL Creds
• 🔒 ASUS Router Remote File Access Service Crash, USB Mount or Root Shell (CVE-2026-88707 - CVE-2026-88710) - Edge Device (SPL) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5801.

Technical analysis

Neither vendor reports in-the-wild exploitation.

On 2026-11-10 Zoom published two security bulletins for Zoom Workplace for Windows. ZSB-26023 (CVE-2026-108186, 'Improper Input Validation', Critical, CVSS 3.1 9.6, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) states the flaw may allow an unauthenticated user to conduct an escalation of privilege via network access. It affects Zoom Workplace for Windows from 7.1.0 up to but not including 7.1.8, so 7.1.8 is the first unaffected release. The bulletin credits Zoom Offensive Security. The CVSS vector has a changed scope and requires user interaction.

ZSB-26024 (CVE-2026-108187, 'Origin Validation Error', High, CVSS 3.1 8.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) describes an origin validation error in Zoom Workplace for Windows that may allow an unauthenticated user to escalate privileges via network access. The bulletin lists affected versions as before 7.1.5 and credits the researcher 'shmoul'. The bulletins do not publish a CWE, technical root cause, or exploit details. The SecurityWeek summary describes both as privilege escalation flaws fixed in 7.1.8 and later.

Also on 2026-11-10, ASUS published 'Security Update for ASUS Router Firmware' (advisory ID 3133). It covers four flaws in a remote file access feature: CVE-2026-88707 (CVSS 7.1 High), CVE-2026-88708 (5.3 Medium), CVE-2026-88709 (7.0 High) and CVE-2026-88710 (8.7 High). Exploitation could allow arbitrary command execution with elevated (root) privileges, or memory overwrites that crash or disrupt the service. One of the four requires physical access through a connected USB storage device. The advisory feed does not name affected router models or fixed firmware versions, so users are told to update to the latest firmware for their model.

Neither Zoom nor ASUS reports exploitation in the wild, and no public proof-of-concept, IOCs, malware, C2 infrastructure or threat actor attribution is stated in the sources. This record is therefore a patch-prioritization and exposure-management item. Defenders should inventory Zoom Workplace for Windows installs below 7.1.8 and ASUS routers with the remote file access feature enabled, then patch. Because no network or file IOCs are published, the IOC list holds scoping indicators (affected products, vendors, reporters, relevant ATT&CK techniques) rather than adversary infrastructure.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1499.004 Application or System Exploitation

Remediation

Patches

• Zoom Workplace for Windows 7.1.8 or later (ZSB-26023, ZSB-26024)
• ASUS Router Firmware latest release (advisory ID 3133)

Immediate actions

• Update Zoom Workplace for Windows to 7.1.8 or later (CVE-2026-108186 affects 7.1.0 up to but not including 7.1.8; CVE-2026-108187 affects versions before 7.1.5)
• Update ASUS router firmware to the latest release for the model, per ASUS advisory 3133
• Inventory Zoom Workplace for Windows versions across endpoints and flag any below 7.1.8

Workarounds

• Disable the ASUS router remote file access feature if unused
• Do not leave untrusted USB storage devices attached to ASUS routers

Longer-term hardening

• Enforce managed, automatic updates for Zoom clients
• Review router exposure of remote file access features and disable them where not needed
• Subscribe to the Zoom security bulletin and ASUS security advisory RSS feeds

Affected and fixed versions

• Zoom — Zoom Workplace for Windows
  Vulnerable versions: 7.1.0 through versions before 7.1.8 (CVE-2026-108186); versions before 7.1.5 (CVE-2026-108187)
  Fixed in: 7.1.8 and later
• ASUS — ASUS Router Firmware (remote file access feature)
  Vulnerable versions: Certain router firmware releases; models not named in advisory feed
  Fixed in: Latest firmware for the affected model

Timeline

• 2026-10-07 ASUS publishes advisory 3120 for router firmware (CVE-2026-14911, CVE-2026-16528, CVE-2026-19386, CVE-2026-19396), the start of a run of ASUS router advisories that precede advisory 3133.
• 2026-11-04 ASUS publishes advisories 3128 (AiCloud, CVE-2026-84730) and 3129 (router firmware, CVE-2026-84729) for adjacent-network attacks.
• 2026-11-10 Zoom Workplace for Windows 7.1.8 is the first release outside the affected range; ASUS directs users to the latest router firmware.
• 2026-11-10 ASUS publishes advisory 3133, 'Security Update for ASUS Router Firmware', covering CVE-2026-88707, CVE-2026-88708, CVE-2026-88709 and CVE-2026-88710 in a remote file access feature.
• 2026-11-10 Zoom publishes ZSB-26023 (CVE-2026-108186, CVSS 9.6, Critical) and ZSB-26024 (CVE-2026-108187, CVSS 8.1, High) for Zoom Workplace for Windows, credited to Zoom Offensive Security and shmoul respectively.
• 2026-11-11 SecurityWeek reports both vendors' patches. Neither vendor reports exploitation in the wild.

Sources cited

• ZSB-26023: Zoom Workplace for Windows - Improper Input Validation (CVE-2026-108186) zoom.com · Advisory · 2026-11-10
• ZSB-26024: Zoom Workplace for Windows - Origin Validation Error (CVE-2026-108187) zoom.com · Advisory · 2026-11-10
• ASUS Security Advisory asus.com · Advisory · 2026-11-10
• ASUS Security Advisory RSS feed (ID 3133: Security Update for ASUS Router Firmware) security-advisory-api.asus.com · Advisory · 2026-11-10
• Zoom Security Bulletins zoom.com · Vendor report · 2026-11-10
• SecurityWeek: Asus, Zoom Release Security Patches SecurityWeek · News · 2026-11-11

More in vulnerability

• Palo Alto Networks PAN-OS (Panorama) Code Injection RCE as Root - CVE-2026-0330
• SignDrop: Unpatched Windows CLFS Zero-Day Enables Local Privilege Escalation to SYSTEM (No CVE)
• Titan Quest: Anniversary Edition heap overflow in .lvl/.pfx file parsing exploited via malicious custom maps (no CVE)
• Microsoft AI-Assisted Research Discloses 59 Linux Kernel Bug Reports (33 CVEs) Incl. 21-Year-Old cls_u32 Flaw CVE-2026-74544; Local Root LPE Exploits Confirmed for 8 CVEs
• Node.js November 2026 Security Releases Patch 16 Vulnerabilities (HTTP/2 crashes, HTTPS heap/TLS key leak CVE-2026-123864, TLS client-certificate auth bypass)

Related coverage of this activity

• Zoom Workplace Windows privilege escalation

Previous and next in vulnerability

• CVE-2026-119618: Critical Unauthenticated RCE via Race Condition in Apache HTTP Server mod_http2 assign_headers() Previous report
• Fortinet2Shell: FortiClient Local API Origin Validation Flaw Enables Code Execution via Malicious Websites (CVE-2026-121529) Next report

Further reading

• Screensaver (.SCR) Files as Initial Access