# Zoom Workplace for Windows Critical Privilege Escalation (CVE-2026-108186, CVE-2026-108187) and ASUS Router Firmware Remote File Access Vulnerabilities (CVE-2026-88707 to CVE-2026-88710) Patched

> Zoom patched two network-reachable privilege escalation flaws in Zoom Workplace for Windows: CVE-2026-108186 (CVSS 9.6, improper input validation) and CVE-2026-108187 (CVSS 8.1, origin validation error). ASUS separately patched four high- and medium-severity flaws in a router remote file access feature that could allow elevated-privilege command execution or a service crash. Neither vendor reports in-the-wild exploitation.

- **Published:** 2026-11-11T22:25:17Z
- **Last reviewed:** 2026-11-11T22:25:17Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5801
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5801.png
- **ID:** TL-2026-5801
- **Severity:** CRITICAL (CVSS 9.6)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 8
- **CVEs:** CVE-2026-108186, CVE-2026-108187, CVE-2026-88707, CVE-2026-88708, CVE-2026-88709, CVE-2026-88710

## Description

On 2026-11-10 Zoom published two security bulletins for Zoom Workplace for Windows. ZSB-26023 (CVE-2026-108186, 'Improper Input Validation', Critical, CVSS 3.1 9.6, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) states the flaw may allow an unauthenticated user to conduct an escalation of privilege via network access. It affects Zoom Workplace for Windows from 7.1.0 up to but not including 7.1.8, so 7.1.8 is the first unaffected release. The bulletin credits Zoom Offensive Security. The CVSS vector has a changed scope and requires user interaction.

ZSB-26024 (CVE-2026-108187, 'Origin Validation Error', High, CVSS 3.1 8.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) describes an origin validation error in Zoom Workplace for Windows that may allow an unauthenticated user to escalate privileges via network access. The bulletin lists affected versions as before 7.1.5 and credits the researcher 'shmoul'. The bulletins do not publish a CWE, technical root cause, or exploit details. The SecurityWeek summary describes both as privilege escalation flaws fixed in 7.1.8 and later.

Also on 2026-11-10, ASUS published 'Security Update for ASUS Router Firmware' (advisory ID 3133). It covers four flaws in a remote file access feature: CVE-2026-88707 (CVSS 7.1 High), CVE-2026-88708 (5.3 Medium), CVE-2026-88709 (7.0 High) and CVE-2026-88710 (8.7 High). Exploitation could allow arbitrary command execution with elevated (root) privileges, or memory overwrites that crash or disrupt the service. One of the four requires physical access through a connected USB storage device. The advisory feed does not name affected router models or fixed firmware versions, so users are told to update to the latest firmware for their model.

Neither Zoom nor ASUS reports exploitation in the wild, and no public proof-of-concept, IOCs, malware, C2 infrastructure or threat actor attribution is stated in the sources. This record is therefore a patch-prioritization and exposure-management item. Defenders should inventory Zoom Workplace for Windows installs below 7.1.8 and ASUS routers with the remote file access feature enabled, then patch. Because no network or file IOCs are published, the IOC list holds scoping indicators (affected products, vendors, reporters, relevant ATT&CK techniques) rather than adversary infrastructure.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1499.004 Application or System Exploitation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Zoom Workplace Client Spawning Script Interpreter or LOLBin (CVE-2026-108186) - Exploitation (SPL)** (`TL-2026-5801-SPL-001`)

Behavioural detection for Zoom Workplace for Windows (7.1.0 - 7.1.7 for CVE-2026-108186, earlier than 7.1.5 for CVE-2026-108187) or its helper processes spawning a command interpreter, script host or living-off-the-land binary. ZSB-26023 and ZSB-26024 publish no exploit signature, so this hunts the client-side execution outcome (T1203, T1059) rather than a payload pattern. A conferencing client has little legitimate reason to launch these children.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1059
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage IN ("*Zoom.exe","*CptHost.exe","*Zoom_launcher.exe","*ZoomWebviewHost.exe") Image IN ("*cmd.exe","*powershell.exe","*pwsh.exe","*wscript.exe","*cscript.exe","*mshta.exe","*rundll32.exe","*regsvr32.exe","*certutil.exe","*bitsadmin.exe")
```TL-2026-5801 CVE-2026-108186 and CVE-2026-108187 Zoom client spawning a shell or LOLBin T1203 T1059```
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(User) as users values(IntegrityLevel) as integrity_levels by host ParentImage Image
| convert ctime(first_seen) ctime(last_seen)
| sort - count
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("Zoom.exe", "CptHost.exe", "Zoom_launcher.exe", "ZoomWebviewHost.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessIntegrityLevel, FileName, ProcessCommandLine, ProcessIntegrityLevel, ReportId
| order by Timestamp desc
```

### Sigma

```yaml
title: Zoom Workplace Client Spawning Script Interpreter or LOLBin (CVE-2026-108186)
id: 7c1f4a52-3b8e-4d6a-9f21-5e0a8b3d6c14
status: experimental
description: Detects the Zoom Workplace for Windows client or its helper processes spawning a command interpreter, script host or common living-off-the-land binary. Behavioural hunt for post-exploitation of the network-reachable Zoom flaws CVE-2026-108186 and CVE-2026-108187 (ZSB-26023, ZSB-26024); no exploit signature is public.
references:
  - https://www.zoom.com/en/trust/security-bulletin/ZSB-26023/
  - https://www.zoom.com/en/trust/security-bulletin/ZSB-26024/
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
  - cve.2026.108186
  - cve.2026.108187
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Zoom.exe'
      - '\CptHost.exe'
      - '\Zoom_launcher.exe'
      - '\ZoomWebviewHost.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Zoom plugins or IT-deployed integrations that legitimately launch helper scripts
  - Zoom update or repair workflows invoking rundll32 or cmd
level: high
```

**Known false positives:**

- Zoom plugins or IT-deployed integrations that legitimately launch helper scripts
- Zoom update or repair workflows invoking rundll32 or cmd

**Tuning notes:** Baseline Zoom child processes for 7 days and exclude known-good command lines. Prioritise hosts still running Zoom Workplace below 7.1.8 by joining with software inventory. Adjust the index name to match your Sysmon index.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Zoom Workplace Client Spawning Script Interpreter or LOLBin (CVE-2026-108186) - Exploitation (KQL) (locked: unlock with TL Creds)
- Zoom Workplace Descendant Process Running at High or SYSTEM Integrity (CVE-2026-108186 / CVE-2026-108187) - Privilege Escalation (KQL) (locked: unlock with TL Creds)
- ASUS Router Remote File Access Service Crash, USB Mount or Root Shell (CVE-2026-88707 - CVE-2026-88710) - Edge Device (KQL) (locked: unlock with TL Creds)
- Zoom Workplace Client Spawning Script Interpreter or LOLBin (CVE-2026-108186) - Exploitation (Sigma) (locked: unlock with TL Creds)
- Zoom Workplace Descendant Process Running at High or SYSTEM Integrity (CVE-2026-108186 / CVE-2026-108187) - Privilege Escalation (Sigma) (locked: unlock with TL Creds)
- ASUS Router Remote File Access Service Crash, USB Mount or Root Shell (CVE-2026-88707 - CVE-2026-88710) - Edge Device (Sigma) (locked: unlock with TL Creds)
- Zoom Workplace Descendant Process Running at High or SYSTEM Integrity (CVE-2026-108186 / CVE-2026-108187) - Privilege Escalation (SPL) (locked: unlock with TL Creds)
- ASUS Router Remote File Access Service Crash, USB Mount or Root Shell (CVE-2026-88707 - CVE-2026-88710) - Edge Device (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [SecurityWeek: Asus, Zoom Release Security Patches](https://www.securityweek.com/asus-zoom-release-security-patches/)
- [Zoom Security Bulletins](https://www.zoom.com/en/trust/security-bulletin/)
- [ZSB-26023: Zoom Workplace for Windows - Improper Input Validation (CVE-2026-108186)](https://www.zoom.com/en/trust/security-bulletin/ZSB-26023/)
- [ZSB-26024: Zoom Workplace for Windows - Origin Validation Error (CVE-2026-108187)](https://www.zoom.com/en/trust/security-bulletin/ZSB-26024/)
- [ASUS Security Advisory](https://www.asus.com/security-advisory/)
- [ASUS Security Advisory RSS feed (ID 3133: Security Update for ASUS Router Firmware)](https://security-advisory-api.asus.com/rss/securityrss.xml)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5801